app-pub[.]info

This domain, app-pub.info, is identified as a credential theft operation masquerading as a legitimate click-rate tracking service under the page title "Quick Click Rate." Analysis indicates the infrastructure is designed to harvest user credentials through deceptive login prompts, likely targeting freelancers or affiliate marketers seeking to inflate engagement metrics. No direct association with known brand impersonation or cryptocurrency drainer kits has been confirmed, but the domain’s structure and content align with credential harvesting tactics observed in similar campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 209.74.65.78 and was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It appears on one security blocklist and is flagged by 6 out of 95 security vendors on VirusTotal. The Gridinsoft trust score for this domain is 0/100, indicating a high-confidence malicious classification. Detected technologies include Apache HTTP Server, Alpine.js, and Unpkg, suggesting a modern web stack potentially used to evade detection or dynamically load malicious payloads. No Google Safe Browsing (GSB) entries were reported at the time of analysis. The domain is currently offline, reducing immediate exposure risk. However, historical DNS records and residual blocklist entries suggest prior malicious activity. Response actions should include monitoring for re-registration under similar naming conventions (e.g., app-pub.net, pub-app.info) and alerting users who may have interacted with the domain during its active period. Organizations are advised to block the IP address 209.74.65.78 at the perimeter and review logs for connections to this domain or its resolved IP. End-users should be cautioned against entering credentials on unverified click-rate or affiliate platforms, particularly those with recent registration dates or low vendor detection rates.