anpomo[.]shop

This domain is classified as a high-risk credential harvesting phishing site. Analysis indicates it employs social engineering tactics to deceive users into disclosing sensitive authentication details, including usernames, passwords, and potentially multi-factor authentication codes. The threat type aligns with targeted phishing campaigns designed to compromise accounts for financial fraud or lateral movement in corporate environments. Infrastructure analysis reveals the domain was registered on June 12, 2026, through West263 International Limited. It resolves to IP address 43.166.240.163 and is currently offline. Detection metrics include 15/95 security vendor flags on VirusTotal, presence in 4 AlienVault OTX threat intelligence pulses, and listings on 2 security blocklists. Google Safe Browsing categorizes it under SOCIAL_ENGINEERING, while two independent threat feeds (seed: db15f2) have actively blocked resolution attempts. Mitigation requires immediate implementation of DNS-based blocking for 43.166.240.163 and domain anpomo.shop across all network security layers. Organizations should deploy email filtering rules to quarantine messages containing this domain or its IP, particularly those mimicking login portals or password reset requests. Security teams must audit authentication logs for successful or failed access attempts referencing this infrastructure between June 12 and its takedown date. User awareness training should emphasize verification of domain authenticity in login prompts, with specific focus on detecting homoglyphs or subdomain spoofing techniques common in credential harvesting campaigns.