foubex[.]com

foubex.com was flagged by Threat Intelligence Analyst 1224e3 as an active phishing domain impersonating financial institutions to steal online banking credentials. This domain leverages a recently registered name—April 21, 2026—and operates from IP address 172.67.160.127 using a valid Let’s Encrypt SSL certificate to appear trustworthy. Its use of NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar and zero VirusTotal detections indicate it has evaded initial detection, increasing the risk of successful user deception. This domain poses a direct threat to users who may enter sensitive login or payment information, exposing them to financial fraud, identity theft, or credential harvesting. Evidence includes domain creation on April 21, 2026, resolution to IP 172.67.160.127, and a clean SSL certificate issued by Let’s Encrypt. With 0 detections on VirusTotal, it currently bypasses most antivirus engines, and its hosting infrastructure aligns with known attacker patterns. Users who accessed or interacted with this domain should assume data compromise and take immediate defensive action. If you visited foubex.com or entered any personal or financial information, cease use of associated accounts immediately and initiate password resets from a known-safe device. Monitor bank accounts and enable two-factor authentication where possible. Report any unauthorized transactions to your financial institution and consider identity protection services. Avoid clicking links from unsolicited emails or messages referencing this domain, and share this advisory to help prevent others from falling victim to this campaign.