app[.]vesper[.]bond

The domain app.vesper.bond is flagged as a generic phishing domain with an elevated risk level. Analysis indicates that this domain was likely used to carry out phishing attacks designed to steal sensitive information from unsuspecting users. The domain’s current offline status suggests that it may have been taken down by authorities or the hosting service, but it remains a potential threat due to its recent creation and the nature of phishing campaigns.

Infrastructure analysis reveals that the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on November 02, 2025. It is currently resolving to the IP address 188.114.97.3 and has been flagged by 7 out of 95 security vendors on VirusTotal. The domain also appears on one security blocklist, indicating that it has been recognized as a threat by at least one security organization. The use of Cloudflare technologies, including Cloudflare Browser Insights and HTTP/3, suggests that the domain may have been hosted on a reputable infrastructure, potentially to gain user trust and evade initial detection.

If users have visited app.vesper.bond, they should immediately check their accounts for any unauthorized activity, especially those related to financial and personal information. Users should also monitor their credit reports and change passwords for any affected accounts. Additionally, it is recommended to enable two-factor authentication (2FA) on all critical accounts to add an extra layer of security. Reporting the incident to the relevant security authorities and the user’s organization’s IT department can help mitigate further risks and prevent the domain from being used in future attacks.