besovex[.]com

This domain, besovex.com, is under investigation for operating as a fake login portal designed to harvest user credentials. Analysis indicates the site mimics legitimate authentication pages, likely targeting corporate or financial service logins. No specific brand impersonation or crypto drainer kit signatures have been confirmed at this stage, though the use of modern JavaScript frameworks suggests a scalable phishing operation. Infrastructure analysis reveals the domain was registered on April 24, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolves to IP address 188.114.96.3 and employs Cloudflare for hosting and DDoS mitigation. Technologies detected include Node.js, React, Next.js, and Webpack, alongside Cloudflare Browser Insights for performance monitoring. Despite its sophisticated setup, the domain currently shows 0/95 detections on VirusTotal and a Gridinsoft trust score of 0/100. It appears on one security blocklist, and Google Safe Browsing has not flagged it as of the latest scan. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. The domain has been taken offline, likely in response to detection by internal security systems. However, the infrastructure remains intact, and the registrar has not suspended the domain. The low detection rate on public scanning platforms suggests the campaign may have been narrowly targeted or evaded automated analysis. Organizations are advised to monitor for credential reuse attempts and review logs for connections to 188.114.96.3 or besovex.com between April 24 and its takedown. No further payload delivery was observed, but the domain's recent creation and rapid takedown align with short-lived phishing operations.