bproject[.]asia

This domain, bproject.asia, is flagged for hosting a generic phishing infrastructure targeting payment systems. The page title "鼎盛支付" (translated as "Prosperous Payment") suggests an attempt to impersonate a legitimate payment gateway, likely to harvest credentials or financial data from victims. No specific drainer kit signatures have been confirmed, but the domain exhibits characteristics consistent with phishing campaigns designed to mimic regional payment processors. Analysis indicates the domain was registered on September 9, 2023, through GoDaddy.com, LLC. It resolves to the IP address 43.228.126.243, which has been associated with other low-reputation domains. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Scamadviser and Gridinsoft assign trust scores of 6/100 and 0/100, respectively. The domain appears on 2 security blocklists and is actively blocked by PhishDestroy and Enkrypt. Google Safe Browsing (GSB) status is not explicitly listed, but the combination of low trust scores and blocklist presence confirms its malicious classification. The domain is currently offline, likely due to takedown actions or infrastructure adjustments by the threat actor. However, residual risk remains, as the IP address and registration details may still be leveraged for future campaigns. Organizations are advised to block the domain and its associated IP at the perimeter, monitor for related indicators of compromise (IOCs), and educate users about phishing tactics targeting payment systems. Continuous vigilance is required, as threat actors frequently re-deploy similar infrastructure under new domains.