accounts[.]gxcwfe[.]icu

The domain accounts.gxcwfe.icu is assessed as having an elevated risk level, specifically for credential phishing activities. This domain is actively being used to steal user credentials, posing a significant threat to individuals and organizations that interact with it.

Analysis indicates that the domain is flagged by 10 out of 95 security vendors on VirusTotal, suggesting a moderate level of consensus regarding its malicious nature. The domain is registered through NameSilo, LLC, and was created on June 14, 2026. It resolves to the IP address 104.21.7.105. The domain is secured with a Let's Encrypt SSL certificate, which may give a false sense of security to unsuspecting users. Technologies detected on this domain include Skolengo, MariaDB, Java, Varnish, Apache Tomcat, SpeedCurve, HSTS, and Google Tag Manager. The presence of these technologies indicates a sophisticated infrastructure capable of handling and processing sensitive user data. Additionally, the domain appears on two security blocklists, further confirming its involvement in malicious activities.

To mitigate the risks associated with credential phishing from this domain, users are advised to avoid clicking on any links or entering personal information on websites that resolve to 104.21.7.105. Organizations should update their firewall and DNS configurations to block traffic to this domain and IP address. Security awareness training should be conducted to educate employees about the signs of phishing, such as unexpected emails, suspicious URLs, and requests for personal data. Regular security audits and monitoring of network traffic can help detect and prevent any attempts to compromise user credentials. Implementing multi-factor authentication (MFA) for all critical accounts and services can also significantly reduce the risk of unauthorized access.