qbointuit[.]app

The domain qbointuit.app was observed hosting a credential‑phishing page that mimics a QuickBooks online login interface, as indicated by the page title “QuickBooks Online Login: Sign in to Access Your QuickBooks Account”. The site is registered through the SC‑GLOBAL‑DATA‑20170615 registrar and is associated with ASN 42624, which maps to Global‑Data System IT Corporation in Switzerland. DNS resolution points to the IPv4 address 185.208.156.66, and the authoritative nameservers are ns1.safe‑networks.net and ns2.safe‑networks.net. No TLS certificate was presented, meaning the site served content over plain HTTP, a common characteristic of low‑cost phishing kits. VirusTotal analysis recorded 15 detections out of 95 scanned engines, and the domain appears on a single external blocklist.

It has also been flagged and taken offline by the PhishDestroy sinkhole, confirming that active mitigation has already been applied. The campaign is classified as credential phishing and specifically targets the brand “argent”, although the page title references QuickBooks, suggesting a possible secondary lure or template reuse. At present the domain is offline, so direct traffic measurement is unavailable. Open‑source intelligence does not reveal additional infrastructure such as shared hosting, CDN use, or related phishing domains. The lack of an SSL certificate and the use of a generic .app TLD are consistent with rapid‑deployment phishing operations.

Defenders should continue to block the IP address 185.208.156.66 and the domain name in DNS filtering solutions, and add the domain to internal threat‑intel feeds. Email gateways should be configured to flag any messages that reference QuickBooks login URLs originating from unknown senders, especially when paired with the “argent” brand name. Users should be reminded to verify TLS indicators and to access financial services only via known, bookmarked URLs.