tenval[.]icu

This domain, tenval.icu, is identified as a generic phishing site designed to mimic a security verification process. Analysis indicates the page title explicitly displays 'Security Check,' suggesting an attempt to deceive users into submitting credentials or personal information under false pretenses. The domain is currently offline, though prior activity confirms its malicious intent. Infrastructure analysis reveals tenval.icu was registered through Global Domain Group LLC on March 22, 2026, an unusual future date that may indicate domain spoofing or registrar manipulation. The domain resolves to IP address 94.183.188.179 and is flagged by 12 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on one security blocklist and was previously blocked by PhishDestroy. Detected technologies include Nginx and OpenResty, common components in phishing infrastructure due to their reverse proxy and load balancing capabilities. Current status confirms tenval.icu has been taken offline, though the underlying infrastructure may remain accessible for future malicious campaigns. Organizations and users are advised to block the domain and its associated IP (94.183.188.179) at the network perimeter. Security teams should monitor for related domains registered under the same registrar or resolving to the same IP range. Endpoint protection systems should be updated to include this domain in phishing detection rules, and users should be educated to recognize 'Security Check' scams, particularly those originating from untrusted or newly registered domains.