clickbusi[.]com

The domain clickbusi.com has been identified as a generic phishing threat. Analysis confirms its classification as a non-brand-specific phishing infrastructure, currently marked offline. No direct impersonation of a known brand was observed, though the domain exhibits characteristics consistent with credential harvesting or malicious redirection campaigns. Infrastructure analysis reveals the domain was flagged by 13 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It was registered through Fewmoretaps OU d/b/a Trustname.com on April 28, 2026, and appears on one security blocklist. The domain resolved to the IP address 34.111.179.208, hosted on infrastructure attributed to a US-based cloud provider. The SSL certificate was issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. Current status confirms the domain has been taken offline, though residual risk may persist if residual DNS records or cached entries remain. Organizations are advised to verify local DNS caches, block the domain and associated IP at perimeter defenses, and monitor for any attempts to re-establish connectivity. Security teams should review logs for prior connections to 34.111.179.208 or the domain itself, particularly from April 2026 onward, to assess potential exposure.