login-botty[.]com

This domain, login-botty.com, is identified as a credential phishing threat designed to deceive users into entering sensitive login credentials on a fraudulent bot service interface. The site mimics legitimate bot or automation tool login portals, tricking victims into submitting usernames, passwords, or API keys under the false pretense of accessing a bot-related service. Such stolen credentials are often exploited for unauthorized account access, financial fraud, or further phishing campaigns targeting associated platforms. Analysis indicates the domain was registered on May 13, 2026, through REG.RU LLC, a registrar frequently observed in malicious infrastructure. Security vendors on VirusTotal flagged the domain in 12 out of 95 scans, while it appears on three security blocklists, including MetaMask and PhishDestroy. The site resolved to the IP address 104.21.93.218, which has been linked to other suspicious domains, and used a Let's Encrypt SSL certificate to create a false sense of legitimacy. The page title 'Botty' further suggests an attempt to impersonate bot-related services, increasing the likelihood of targeting users in automation or cryptocurrency communities. Users who visited login-botty.com or entered credentials on the site should immediately revoke any submitted login details, including passwords, API keys, or session tokens. Change passwords for all accounts where the same credentials were reused, and enable multi-factor authentication where available. Monitor linked accounts for unauthorized activity, such as logins from unfamiliar locations or devices. If financial or cryptocurrency platforms were accessed, review transaction histories for fraudulent activity. Organizations should block the domain and its resolving IP at the network level to prevent further exposure.