qbointuitapi[.]com[.]qbointuit[.]app

Analysis of the domain qbointuitapi.com.qbointuit.app indicates it was used for credential phishing targeting the brand argent. The site presented the page title "QuickBooks Online Login: Sign in to Access Your QuickBooks Account," suggesting an attempt to harvest login credentials under the guise of a legitimate QuickBooks portal. The domain is registered through the SC-GLOBAL-DATA-20170615 block (ASN 42624) and resolves to the IPv4 address 185.208.156.66, which is allocated to Global-Data System IT Corporation in Switzerland (CH). No SSL certificate was observed for the host, meaning traffic was unencrypted and vulnerable to interception.

Nameserver information could not be retrieved (NS_NOT_FOUND). The domain appears on a single security blocklist and has been blocked by PhishDestroy. VirusTotal reports indicate the domain was scanned by 95 vendors without any detections at the time of analysis, but the absence of detections does not confirm safety. The infrastructure is currently offline, and the domain has been taken down.

Uncertainties remain regarding the full scope of the phishing campaign, such as whether additional domains share the same hosting or if email distribution methods have been employed. Defenders should continue to monitor for related indicators, block the IP address 185.208.156.66 and the domain in network filters, and update threat intelligence feeds with the observed attributes. Organizations using QuickBooks or the argent brand should alert users to the possibility of credential harvesting attempts and encourage verification of URLs before entering credentials.