soybeans[.]ai

The domain soybeans.ai has been identified as a credential harvesting phishing endpoint targeting unsuspecting users. Analysis confirms the domain is currently offline, though it previously hosted content masquerading as a legitimate service to capture sensitive authentication details. No specific brand impersonation was detected in available metadata, though the generic phishing framework suggests broad targeting of login credentials across multiple platforms. Infrastructure analysis reveals the domain was registered on November 7, 2025, through NameCheap, Inc., a registrar frequently associated with both legitimate and malicious registrations. The domain resolves to the IP address 44.232.173.249, hosted on Amazon.com, Inc. infrastructure (AS16509), a common cloud provider leveraged for phishing campaigns due to its scalability and ephemeral hosting capabilities. Security vendor detections are significant, with 9 of 95 VirusTotal engines flagging the domain as malicious. Additionally, the domain appears on two distinct security blocklists, including PhishDestroy and ScamSniffer, further corroborating its malicious classification. The SSL certificate, issued by Let's Encrypt (R13), provides minimal assurance, as automated certificate issuance is routinely exploited by threat actors to lend superficial legitimacy to phishing pages. Current status indicates the domain has been taken offline, likely in response to detection and reporting. However, the infrastructure remains a potential risk, as threat actors may redeploy the domain or repurpose the hosting environment for future campaigns. Organizations are advised to proactively block the domain and associated IP address (44.232.173.249) at the network perimeter. Security teams should monitor for related indicators of compromise, including domains registered through the same registrar or hosted on adjacent IP ranges within AS16509. End users should be educated on recognizing phishing attempts, particularly those leveraging newly registered domains or cloud-hosted infrastructure. Continuous threat intelligence monitoring is recommended to identify resurgence or evolution of this campaign.