cilckbus[.]com

This domain, cilckbus.com, is identified as a credential harvesting phishing site designed to mimic legitimate login portals for financial or personal data theft. Analysis indicates the domain was crafted to deceive users into entering sensitive credentials, such as usernames, passwords, or payment details, which are then exfiltrated to attacker-controlled infrastructure. The threat primarily targets individuals seeking transportation or travel-related services, leveraging social engineering tactics to exploit trust in well-known brands or services.

Infrastructure analysis reveals cilckbus.com was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with malicious domain registrations. The domain resolves to the IP address 34.111.179.208, hosted on a cloud provider in the United States, a common tactic to evade geofencing or regional blocklists. VirusTotal detections confirm the domain is flagged by 10 out of 95 security vendors, while it appears on one security blocklist. The SSL certificate, issued by Let's Encrypt (serial number E7), provides minimal encryption but does not validate the legitimacy of the site. The domain's current offline status suggests takedown action, though historical exposure remains a risk.

Users who visited cilckbus.com or entered credentials on the site should immediately revoke and reset any exposed passwords, particularly for financial, email, or corporate accounts. Enable multi-factor authentication (MFA) on all critical services to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized transactions or login attempts from unfamiliar locations. If payment details were submitted, contact financial institutions to flag potential fraud. Organizations should block the domain and associated IP (34.111.179.208) at the network perimeter and update endpoint protection rules to prevent future access. Preserve logs of any interactions with the domain for forensic analysis or reporting to relevant authorities.