nxk[.]slj[.]mybluehost[.]me

PhishDestroy identifies nxk.slj.mybluehost.me as a live credential phishing domain operating under a generic hosting provider. This domain has no direct brand association in its naming, indicating a likely opportunistic campaign targeting unsuspecting users through deceptive login forms. The infrastructure leverages shared hosting environments, a common tactic for low-cost malicious operations, to distribute fraudulent content without requiring dedicated server resources.

This domain was flagged by 10 out of 95 security vendors on VirusTotal and resolves to IP address 50.6.245.246. Registered via Domain.com on October 05, 2016, it uses a Let's Encrypt SSL certificate to appear legitimate. The domain is currently blocked by OpenPhish and appears on one active security blocklist, suggesting moderate but confirmed malicious activity. Its extended registration lifespan is atypical for disposable malicious domains and may indicate reuse in multiple low-sophistication campaigns over time.

The domain remains active and poses an elevated risk due to its credible hosting environment and SSL certificate. Users who encounter this domain should immediately cease interaction, avoid inputting credentials, and report the domain to their security provider. Organizations are advised to block the domain and IP at the network perimeter. While detection coverage is partial, continued monitoring is essential due to the domain’s longevity and reuse in opportunistic attacks.