butterfieldgrpbk[.]online[.]ekpsuckass[.]com

Infrastructure analysis indicates that butterfieldgrpbk.online.ekpsuckass.com is associated with a generic phishing operation consistent with fake login credential harvesting. The observed naming structure and subdomain composition are characteristic of phishing infrastructure designed to imitate legitimate online services and capture user authentication data. No verified brand attribution or specialized credential theft kit has been identified from the available intelligence; however, the domain exhibits multiple indicators commonly associated with active phishing campaigns and unauthorized credential collection activity.

Technical indicators support a high-risk assessment. The domain is currently active and was created on April 16, 2026. Registration records show the domain was registered through NameCheap, Inc. Resolution data maps the infrastructure to IP address 198.251.84.141 located in the United States within AS53667. Security telemetry shows that 5 out of 95 security vendors flag the domain as malicious on VirusTotal. The domain appears on 1 security blocklist and has been blocked by PhishDestroy. SSL services are present through a Let's Encrypt certificate (YR1), a common configuration frequently observed across both legitimate and malicious internet infrastructure. No information is available indicating removal from security filtering systems, and the domain remains operational at the time of assessment.

Current status remains active, increasing the likelihood of continued phishing exposure. Given the combination of active infrastructure, security detections, blocklist inclusion, and credential-harvesting characteristics, the residual risk is assessed as high. Defensive actions should include immediate blocking of the domain and associated IP address 198.251.84.141, monitoring for related indicators across network telemetry, reviewing authentication logs for suspicious access attempts, and conducting user awareness notifications where exposure is suspected. Organizations should inspect email, web proxy, DNS, and endpoint records for historical interactions with the domain. Continued monitoring is recommended because active phishing infrastructure may be repurposed, expanded, or migrated to related domains while remaining operational.