buegamb[.]cc

PhishDestroy identifies buegamb.cc as a live credential-harvesting domain currently weaponized for phishing campaigns. This domain was designed to mimic trusted services and trick users into submitting login credentials or sensitive information. The threat is active and ongoing, with the attacker infrastructure hosted behind Cloudflare at 172.67.200.215. Threat intelligence shows this domain is part of a broader operation targeting unsuspecting victims through spoofed login portals. This domain was flagged by five of ninety-five VirusTotal security vendors at first sighting and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 28 2026, just days ago. The attacker rapidly provisioned a Let’s Encrypt SSL certificate to enhance credibility and blend in with legitimate web traffic. Despite its new age, the domain already carries elevated risk due to its clear intent and weaponized configuration. Users who accessed or entered data on buegamb.cc should immediately change any passwords that may have been exposed and enable multi-factor authentication wherever possible. Monitor financial accounts and emails for signs of credential abuse or follow-up phishing attempts. Report the domain to your security team or block it at the network perimeter to prevent further engagement. Organizations are advised to inspect proxy logs for outbound connections to 172.67.200.215 as part of incident response.