h6[.]ciimud7[.]vu

This domain, h6.ciimud7.vu, is flagged as a high-risk credential harvesting phishing site. Analysis indicates it impersonates the Energen brand, leveraging a free Bootstrap 4 template titled 'Energen - Free Bootstrap 4 Template by Colorlib' to create a facade of legitimacy. No specific drainer kit signatures were identified, but the use of a generic template suggests broad targeting for credential theft or malware distribution. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on March 11, 2026, through Sav.com LLC and resolves to IP address 95.3.220.175, hosted on AS9121 (Turk Telekomunikasyon Anonim Sirketi). Google Safe Browsing explicitly flags it as phishing, while VirusTotal reports 19 out of 95 security vendors detecting malicious activity. It appears on one security blocklist and was blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt (R12), a common tactic to evade browser warnings. The domain is currently offline, likely due to takedown actions or infrastructure suspension. However, residual risk remains for users who may have interacted with it during its active period. Organizations should monitor for credential reuse attempts, particularly if the domain was accessed internally. Network defenders are advised to block the domain, its resolved IP, and associated SSL certificate thumbprints in perimeter defenses. Continuous monitoring for related domains registered through the same registrar or hosted on the same IP range is recommended to preempt potential follow-up campaigns.