bowatu[.]com

PhishDestroy identifies bowatu.com as a high-risk credential harvesting domain currently under active investigation.

This domain was flagged for hosting a credential harvesting campaign, with zero detections out of 95 VirusTotal engines as of the latest scan. VirusTotal flags were absent despite the domain’s short operational window. The domain resolves to IP 188.114.97.3, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 17, 2026. No historical presence on major blocklists or trust score degradation has been observed, suggesting it may be newly deployed. The SSL certificate was issued by Let’s Encrypt, indicating an attempt to establish trustworthiness.

Given the absence of detections and the domain’s recent creation, there is an elevated risk of undetected credential theft operations. Targets typically include users of financial, e-commerce, or enterprise login portals. The combination of a clean reputation, recent registration, and SSL support is a common tactic in credential harvesting campaigns. Threat actors often leverage newly registered domains to evade detection before establishing a malicious reputation.

Organizations and users should immediately block access to bowatu.com at the DNS and firewall levels. Employees should be alerted to avoid entering credentials on this domain, and any captured credentials should be rotated immediately. Continuous monitoring for associated IP addresses and subdomains is recommended, as threat actors frequently expand infrastructure to sustain phishing operations. Reporting to threat intelligence platforms and local CERT teams is encouraged to accelerate detection and mitigation.