radianite[.]icu

This domain, radianite.icu, is assessed as an elevated-risk credential theft phishing site. Analysis indicates it was actively used to deceive users into submitting login credentials through fraudulent web forms, likely mimicking legitimate services or platforms to capture sensitive account information. The infrastructure and tactics align with known credential harvesting campaigns, where stolen data is exploited for unauthorized access or sold in underground markets.

Infrastructure analysis reveals the domain resolved to IP address 94.183.188.179 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026. Security vendors flagged the domain in 13 out of 95 detections on VirusTotal, while AlienVault OTX associated it with one threat intelligence pulse. The domain holds a Gridinsoft trust score of 0/100 and appears on one security blocklist. Additionally, it was blocked by PhishDestroy, further corroborating its malicious classification. The creation date discrepancy (2026) suggests potential domain squatting or registration abuse, a common tactic in phishing operations to evade detection.

Mitigation against credential theft phishing requires multi-layered defenses. Administrators should ensure the domain and its associated IP (94.183.188.179) are blocked at the network level via firewalls or DNS filtering. Users should be trained to recognize phishing indicators, such as mismatched URLs, urgent language, or unsolicited login requests. Enabling multi-factor authentication (MFA) on all accounts reduces the impact of credential compromise. Organizations are advised to monitor for unauthorized access attempts linked to this domain and conduct password resets for any accounts exposed to the site. Historical logs should be reviewed for interactions with radianite.icu to identify potential breaches.