tinyhub[.]vip

This domain, tinyhub.vip, is identified as a credential harvesting phishing site designed to mimic legitimate login portals. Analysis indicates its primary objective is to deceive users into submitting sensitive authentication details, such as usernames, passwords, and potentially multi-factor authentication codes, which are then exfiltrated to attacker-controlled infrastructure. The domain employs social engineering tactics, often presenting itself as a trusted service or platform, to increase the likelihood of successful credential theft. Evidence supporting this assessment includes detection by 19 out of 95 security vendors on VirusTotal, with the domain appearing on at least one security blocklist. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., and resolves to the IP address 47.77.216.153, hosted under AS45102 (Alibaba (US) Technology Co., Ltd.). The SSL certificate is issued under the common name PhishDestroy / botadmin.destroy.tools, further indicating its association with phishing infrastructure. The domain’s page title, matching its URL (tinyhub.vip), suggests minimal effort to disguise its fraudulent nature. Users who have visited tinyhub.vip or entered credentials on the site should immediately take corrective actions. All passwords associated with the compromised credentials must be changed across any platforms where they were reused. Multi-factor authentication (MFA) should be enabled on all critical accounts, and users are advised to monitor for unauthorized access or suspicious activity. If financial or personally identifiable information was submitted, affected individuals should report the incident to relevant authorities and consider credit monitoring services. Network administrators are recommended to block the domain and its associated IP (47.77.216.153) at the perimeter to prevent further exposure.