app[.]hallybeeverify[.]com[.]ng

The domain app.hallybeeverify.com.ng was observed hosting a credential‑phishing site that impersonates the brand "across". The site presented the page title "ASDATALINK - Your Trusted VTU Partner | Buy Airtime, Data, Cable & Utility", indicating an attempt to lure victims with utility and telecom services. DNS resolution points to the IPv4 address 92.204.41.13, which is registered to AS29066 (velia.net Internetdienste GmbH) and geolocated to France. No nameserver records were returned, listed as NS_NOT_FOUND, and the domain lacked an SSL certificate, exposing any traffic to passive interception.

The infrastructure has been flagged by a single security blocklist and is specifically listed as blocked by PhishDestroy. VirusTotal scans recorded two positive detections out of ninety‑three security vendors, confirming malicious activity. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low confidence in the domain’s legitimacy.

The site is currently offline, but historical evidence confirms it operated as a credential‑phishing portal. Defenders should continue to block the domain and its associated IP address, monitor for any re‑hosting attempts, and incorporate the indicator set into intrusion‑detection signatures. Additional analysis is limited by the offline status, so any future activity should be re‑examined for changes in hosting, TLS adoption, or content modifications.