11365app[.]com

The domain 11365app.com has been identified as a credential theft operation designed to harvest sensitive user login information through deceptive means. Analysis confirms the domain is currently offline, though prior activity suggests it was actively used to mimic legitimate authentication portals. The specific threat type involves impersonating trusted platforms to trick users into submitting credentials, which are then exfiltrated for malicious purposes. Infrastructure analysis reveals the domain was flagged by 19 of 95 security vendors on VirusTotal, indicating broad detection of its malicious intent. It was registered on December 14, 2025, through ERANET INTERNATIONAL LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 65.75.210.120, which has been linked to other suspicious activities. Additional technical indicators include a Gridinsoft trust score of 0/100 and presence on one security blocklist. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, while detected technologies include Nginx, HSTS, and HTTP/3, which may have been leveraged to enhance the appearance of legitimacy. Given the elevated risk level and confirmed malicious activity, organizations and individuals are advised to treat this domain as a verified threat. Immediate actions should include blocking the domain and its associated IP (65.75.210.120) at the network perimeter, as well as monitoring for any residual connections or attempts to reuse the infrastructure. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Security teams are encouraged to review logs for connections to the domain or IP and correlate with other indicators of compromise to assess potential impact.