com-wr[.]icu

This domain is flagged as a credential harvesting phishing site, classified under an elevated risk level due to its active targeting of authentication credentials. Analysis indicates the infrastructure was designed to mimic legitimate login portals, a common tactic in credential theft campaigns. The domain remains inactive at the time of assessment, though prior activity warrants continued monitoring. Infrastructure analysis reveals the domain com-wr.icu resolved to IP address 172.67.173.106 and was registered through Dynadot LLC on October 29, 2025. Detection metrics show 6 out of 95 security vendors flagged the domain on VirusTotal, while it appears on a single security blocklist. The Gridinsoft trust score for this domain is 0/100, reinforcing its malicious classification. The page title, matching the domain name, suggests a lack of obfuscation, potentially indicating a hastily deployed campaign. Mitigation against credential harvesting phishing domains involves implementing multi-factor authentication (MFA) for all critical accounts to reduce the impact of stolen credentials. Network-level protections should include blocking the domain and its associated IP address (172.67.173.106) at firewalls and DNS resolvers. Organizations should conduct retrospective log analysis to identify any prior interactions with the domain and reset credentials for potentially compromised accounts. User awareness training should emphasize recognizing suspicious login prompts and verifying domain authenticity before entering credentials.