moneyfo[.]icu

This domain, moneyfo.icu, is under investigation for credential harvesting phishing targeting financial services users. Analysis indicates the infrastructure is designed to mimic legitimate banking or payment portals, likely aiming to capture login credentials, payment details, or personal identification information. The campaign appears to be in an early operational phase, given its recent deployment and lack of widespread detection. Infrastructure analysis reveals the domain was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. As of the latest assessment, the domain resolves to the IP address 150.241.70.157, which has no prior blocklist history but is hosted in a region with known concentrations of fraudulent activity. VirusTotal detection metrics show 0 out of 95 security engines currently flagging the domain, suggesting either evasion techniques or recent activation. No entries exist on major threat intelligence feeds, though this may reflect a deliberate delay in deployment to avoid preemptive detection. Users who have visited moneyfo.icu or interacted with content hosted on this domain should immediately cease all engagement and initiate remediation protocols. This includes resetting credentials for any accounts accessed during the interaction period, particularly financial or email accounts. Network administrators are advised to block the domain and its resolving IP (150.241.70.157) at the perimeter level to prevent further exposure. Monitoring for anomalous authentication attempts or unauthorized transactions is critical, as compromised credentials may be exploited in subsequent attacks. Given the domain’s recent registration and lack of detection, this campaign may escalate rapidly, warranting heightened vigilance.