admin-28396[.]bubbleapps[.]io

This domain is flagged as an elevated-risk generic phishing site specializing in fake login portal impersonation. Analysis indicates the infrastructure was designed to harvest credentials by mimicking legitimate authentication interfaces, a common tactic in credential theft campaigns targeting cloud-based application users. Infrastructure analysis reveals the domain admin-28396.bubbleapps.io was created on January 14, 2016, and is registered through Cloudflare, Inc. It resolves to the IPv6 address 2606:4700::6812:f518, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1). Security telemetry shows 14 out of 95 vendors on VirusTotal flag the domain as malicious, and it appears on 2 security blocklists. The page title 'Bubble | No-code apps' suggests an attempt to impersonate the legitimate Bubble.io platform, a common target for phishing campaigns due to its widespread use in no-code application development. Mitigation requires immediate blocking of the domain and its resolving IP (2606:4700::6812:f518) at the network perimeter. Security teams should invalidate any credentials potentially exposed through this portal, particularly those associated with cloud-based application development platforms. Monitor for anomalous authentication attempts originating from internal networks, and implement multi-factor authentication (MFA) enforcement for all accounts with access to sensitive development environments. Review logs for connections to the domain or its IP within the past 30 days, focusing on successful authentication events. Disseminate indicators of compromise (IOCs) to endpoint detection systems and email security gateways to prevent further exposure.