zzbaawva[.]click

This domain is flagged as an elevated-risk credential theft operation designed to harvest login credentials through a fraudulent Chinese-language portal. Analysis indicates the site mimics authentication pages, presenting a direct threat to users who enter sensitive account information, which is then exfiltrated to attacker-controlled infrastructure. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain zzbaawva.click resolves to IP address 82.152.64.210, hosted on AS206300 (YUNYOO LTD) in Great Britain. Registered through Global Domain Group LLC on February 21, 2026, the domain exhibits an anomalous future creation date, suggesting potential WHOIS manipulation. No SSL certificate is present, increasing exposure to interception. The domain appears on one security blocklist and is flagged by 18 out of 95 security vendors on VirusTotal, with detection engines identifying credential harvesting patterns. To mitigate credential theft risks, users should avoid entering any login details on this domain. Organizations should block the domain and associated IP at network perimeter controls. Endpoints should be scanned for indicators of compromise, particularly if users accessed the site. Multi-factor authentication should be enforced on all accounts to reduce impact from stolen credentials. Network logs should be reviewed for connections to 82.152.64.210 or related domains registered through the same registrar. Security teams should monitor for phishing campaigns distributing this domain and educate users on recognizing fraudulent login portals, particularly those using non-Latin scripts or unexpected language prompts.