muf-52356[.]bubbleapps[.]io

The domain muf-52356.bubbleapps.io is currently active and has been classified as a generic phishing infrastructure. Registration data indicates the domain was created through the Bubble Group registrar, which is commonly used for legitimate no‑code application hosting. DNS resolution points to the IP address 104.18.245.24, a host that belongs to the Cloudflare network and is often shared among many unrelated sites, making IP‑based attribution unreliable. The domain fails to resolve its authoritative nameservers; the NS lookup returns NS_NOT_FOUND, suggesting either a misconfiguration or deliberate obfuscation.

Reputation services show consistent detection. VirusTotal records 14 of 91 security vendors flagging the domain, and two independent phishing blocklists—PhishDestroy and OpenPhish—have already listed it. No additional public blocklists are observed beyond these two entries. Safe Browsing and other Google‑based checks are not explicitly reported in the supplied intelligence, and no OTX indicators have been disclosed.

SSL/TLS details, HTTP response codes, and page‑title metadata are not available, preventing a full surface‑level assessment of the landing page. Given the confirmed presence on multiple phishing blocklists and the multi‑vendor detection count, defenders should treat connections to this domain as malicious. Recommended actions include updating network firewalls and DNS filtering policies to block the domain and its resolved IP, adding the domain to internal threat‑intel feeds, and monitoring for any outbound traffic that may indicate compromised clients attempting credential exfiltration. Continuous re‑evaluation is advised, as further evidence such as page content or additional detection sources could emerge.