b033[.]app

This domain, b033.app, operates as a fake login portal designed to harvest user credentials through deceptive authentication interfaces. Analysis indicates the site mimics legitimate login pages, likely targeting unsuspecting users attempting to access accounts or services. The absence of an SSL certificate further increases the risk of credential interception during transmission, as data exchanged with the domain is transmitted in plaintext, making it vulnerable to eavesdropping or man-in-the-middle attacks. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain is flagged by 15 out of 95 security vendors on VirusTotal, with a registration date of September 03, 2025, through Gname.com Pte. Ltd. It resolves to the IP address 45.196.247.189, hosted under AS140224 (Nebula Global LLC) in Hong Kong. The domain appears on two security blocklists and was previously blocked by at least two threat intelligence feeds. The page title, 81785.xyz, suggests an attempt to redirect or mislead users to another malicious endpoint. Users who visited b033.app should immediately revoke any entered credentials, particularly if reused across other platforms. Monitor accounts associated with the credentials for unauthorized access or transactions. Clear browser cache and cookies to remove any residual session data. If financial or sensitive information was submitted, enable additional authentication measures and consider reporting the incident to relevant authorities or identity protection services. Network administrators should block the domain and its resolving IP (45.196.247.189) at the perimeter to prevent further exposure.