02-billing[.]link

The domain 02-billing.link has been identified as a credential theft operation, designed to harvest user login credentials through deceptive login portals. Analysis confirms the domain is currently offline, though prior activity suggests it was actively targeting victims with fraudulent authentication interfaces. No specific brand impersonation has been confirmed, but the infrastructure aligns with broader credential harvesting campaigns. Infrastructure analysis reveals the domain was registered on September 12, 2025, through GMO Internet, Inc., and resolved to the IP address 199.59.243.228, hosted on Amazon.com, Inc. (AS16509) infrastructure. Security vendors flagged the domain in 18 of 95 VirusTotal scans, indicating moderate detection coverage. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and was secured with a Let's Encrypt SSL certificate (R13). The page title, 02-billing.link, further suggests an attempt to mimic legitimate billing or authentication portals. Given the domain's current offline status, immediate risk to users is reduced. However, organizations should monitor for related infrastructure reactivation or domain reuse. Defenders are advised to block the domain and associated IP (199.59.243.228) at the network level, update endpoint protection rules to detect credential theft attempts, and educate users on recognizing fraudulent login prompts. Historical indicators should be retained for retrospective threat hunting.