bully[.]domains

This domain, bully.domains, is identified as a credential theft phishing site designed to impersonate legitimate login portals for the purpose of harvesting user credentials. Currently, the domain is offline, though prior activity indicates it was actively used in phishing campaigns targeting unsuspecting users. Analysis of the page title, 'Portal Home - Bully.Domains,' suggests an attempt to mimic a generic authentication gateway, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 185.125.219.232 and is flagged by 3 of 95 security vendors on VirusTotal, indicating confirmed malicious activity. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, further corroborating its fraudulent nature. Additionally, it was detected in one AlienVault OTX threat intelligence pulse, and its SSL certificate, issued by Let's Encrypt, does not mitigate the underlying threat. The domain was also blocked by PhishDestroy, a specialized anti-phishing system. Given the elevated risk level and confirmed malicious infrastructure, users and organizations are advised to treat bully.domains as a high-priority threat. Immediate actions include blacklisting the domain and its associated IP (185.125.219.232) at the network perimeter, as well as implementing browser-based blocking mechanisms. Security teams should conduct retrospective analysis to identify any prior interactions with this domain within their logs. End-users who may have visited the site should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Continuous monitoring for related domains registered through the same registrar is recommended to preemptively mitigate similar threats.