huh-iu-g[.]sbs

This domain, huh-iu-g.sbs, is flagged as a confirmed phishing infrastructure impersonating Mastercard’s International Card Services (ICS) login portal. Analysis indicates the site employs brand impersonation tactics to facilitate credential theft, specifically targeting users of Mastercard’s ICS platform. The page title, 'Inloggen - Mijn ICS | International Card Services,' directly mimics the legitimate ICS login interface, increasing the likelihood of successful deception among Dutch-speaking users. Infrastructure analysis reveals the domain was registered on December 29, 2025, through Global Domain Group LLC, a registrar frequently associated with malicious activity. It resolves to the IP address 193.228.128.5, hosted on AS215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) in Switzerland. The domain is flagged by 17 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. The SSL certificate is identified as R13, a common indicator in phishing campaigns. No Google Safe Browsing (GSB) detection was reported at the time of analysis, suggesting the domain may have evaded initial detection mechanisms. The domain has since been taken offline, likely due to intervention by security providers or hosting abuse teams. However, the infrastructure remains a residual risk, as threat actors may repurpose the IP or registrar for future campaigns. Users who interacted with the site are advised to reset credentials immediately, particularly for financial services, and monitor accounts for unauthorized activity. Organizations should update blocklists to include the domain and associated IP to prevent future access attempts. The elevated risk level is justified by the domain’s direct targeting of financial credentials and its use of a trusted brand to enhance credibility.