am[.]bkclxc[.]shop

PhishDestroy identifies am.bkclxc.shop as a generic phishing domain impersonating banking login portals to harvest credentials. The domain is currently active and leverages a deceptive subdomain structure (am.bkclxc.shop) to mimic legitimate banking domains, suggesting an attempt to trick users into entering sensitive financial information. While the specific drainer kit remains unverified, the domain's construction aligns with common phishing tactics used to bypass basic security filters.

This domain was flagged with a generic phishing threat type and is hosted on IP 172.67.137.94. VirusTotal currently reports 5/95 detections, indicating it has evaded initial antivirus and security vendor scrutiny. The domain uses a Let's Encrypt SSL certificate, which is often exploited by threat actors to appear legitimate. Registration details for am.bkclxc.shop are not publicly available, but its recent creation and active status suggest a hastily deployed campaign. Google Safe Browsing (GSB) has not yet flagged the domain, and public blocklists show no prior detections. The domain resolves to a Cloudflare IP (172.67.137.94), which is commonly abused for phishing due to its rapid provisioning and anonymity features.

The current risk level for am.bkclxc.shop is marked as 'under_investigation' but remains active, posing an immediate threat to unsuspecting users. Security researchers should treat this domain with caution, as its low detection rate may indicate a newly launched campaign. Users are advised to avoid interacting with the domain and report any suspicious activity. Immediate actions include blocking the IP (172.67.137.94) and domain at the network level, while further forensic analysis is conducted to uncover additional infrastructure ties. Despite its low initial detection score, the domain's behavior and construction warrant high vigilance until definitive classification is achieved.