zibber022[.]com

This domain is flagged as a high-risk credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates the domain operates under the generic_phishing threat type, designed to capture sensitive authentication details such as usernames, passwords, and multi-factor authentication codes. The infrastructure and page behavior suggest a focus on impersonating legitimate services to exploit user trust. Infrastructure analysis reveals the domain zibber022.com was registered on July 05, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 178.16.54.222 and is currently active, displaying a page title of 'Just a moment...' indicative of cloaking or redirection mechanisms. The domain appears on 1 security blocklist and is referenced in 1 AlienVault OTX threat intelligence pulse. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious. Additional technical indicators include the use of Varnish, Amazon Web Services, HSTS, and Amplitude for tracking or evasion. The domain holds a Gridinsoft trust score of 0/100 and employs a Let's Encrypt SSL certificate, which is commonly abused in phishing campaigns to appear legitimate. Mitigation against this credential harvesting threat requires immediate action. Network administrators should block the domain zibber022.com and its resolving IP 178.16.54.222 at the firewall or proxy level. Endpoint protection systems should be updated to include this domain in denylists, and security teams should monitor for any connections to the associated IP or domain. Users should be educated to recognize phishing indicators, such as unexpected login prompts, mismatched URLs, and SSL certificate warnings. If credentials were entered on this site, they must be reset immediately across all platforms where they were reused. Organizations should enforce multi-factor authentication to mitigate the impact of credential compromise.