Fake insurance renewal portals with live operator approval of UPI and card payments (ICICI Lombard lure)

Fake online renewal and policy soft-copy portals for an Indian insurer, built as a single-page web app with its own backend. A visitor enters a policy number, is shown a renewal premium and is asked to pay, either by UPI (a QR code and payment links to the operator's UPI ID) or by card or net banking with an OTP step. Each payment is held as pending until the operator approves it from a live admin panel. The same app carries advisor and admin portals, customer records, a generator for personalised renewal and soft-copy links sent to policyholders, and downloadable PDF 'policy documents'. Seen impersonating ICICI Lombard at icicilombardsrenewal[.]com, icicilombardrenewal[.]com, icici-lombardrenewal[.]com and icicilombardonlinerenewal[.]com between August and November 2026; the operator moves the app to a new look-alike domain when one stops resolving to it. A match means a page built from this app, whatever brand it shows, or one of the known hosts.