ppbx4-wqaaa-aaaap-qhs7a-cai[.]icp0[.]io

This domain, ppbx4-wqaaa-aaaap-qhs7a-cai.icp0.io, is flagged for credential theft activity under the guise of the platform 'Budy.' Analysis indicates no direct association with known crypto drainer kits or brand impersonation of major financial or technology entities. The page title 'Budy' suggests an attempt to mimic a legitimate service, likely to harvest user credentials or sensitive information through deceptive login prompts or forms. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IPv6 address 2602:fb2b:110:1:bcfb:b8ff:fe09:c741 and was registered through GoDaddy.com, LLC on September 06, 2022. VirusTotal reports 0 out of 95 detections, indicating no immediate flags from participating security vendors. However, the domain appears on one security blocklist, and Gridinsoft assigns it a trust score of 0/100. The domain employs HSTS and uses a Let's Encrypt SSL certificate, which, while common for legitimate sites, does not preclude malicious use. Google Safe Browsing status is not explicitly provided, but the domain has been blocked by PhishDestroy. As of the latest assessment, the domain is offline, reducing immediate exposure risk. However, the infrastructure remains registered and could be reactivated. The absence of detections on VirusTotal does not guarantee safety, as the domain has already been flagged by one security source. Users and organizations are advised to monitor for reactivation attempts, block the domain at the network level, and verify any communications claiming affiliation with 'Budy' through independent channels. Remaining risk includes potential reuse of the domain or IP for future malicious campaigns.