bbva[.]stockbrokers[.]com[.]mx

Analysis of bbva.stockbrokers.com.mx indicates an active high‑risk phishing infrastructure targeting cryptocurrency users. The domain resolves to 158.23.105.3, an IP address allocated to AS8075 Microsoft Corporation in Mexico, and serves over HTTPS using a DigiCert / GeoTrust TLS RSA CA G1 certificate. HTTP requests return a 302 redirect, and the page title is reported as "StockBrokers LP". The site is built on PHP with front‑end libraries including Bootstrap, jQuery, Modernizr, OWL Carousel, and runs on Nginx. Reputation services assign a 1/100 Scamadviser score and a 0/100 Gridinsoft score, and the domain appears on two phishing blocklists (PhishDestroy, PhishingDB). VirusTotal scans show nine of ninety‑five security vendors flagging the domain. Registration data shows creation on 23 Oct 2010 via Wild West Domains, with nameservers ns1.stockbrokers.com.mx and ns2.stockbr. The only confirmed malicious behavior is the classification as a crypto‑related phishing scam; the exact content of the landing page, credential‑capture mechanisms, or payload delivery have not been publicly disclosed. Defenders should block the domain at perimeter filters, monitor DNS queries for the associated IP and nameservers, and enforce TLS inspection to detect the 302 redirect. Incident response teams should treat any credentials or wallet information submitted to this site as compromised and advise affected users to revoke access and rotate credentials immediately.