easybank-landing-page-rho[.]now[.]sh

This domain is classified as a high-risk banking phishing threat targeting financial credentials. Analysis indicates the infrastructure is actively mimicking legitimate banking services to harvest sensitive user data, including login credentials and personal identification details. Infrastructure analysis reveals the domain easybank-landing-page-rho.now.sh was registered through Amazon Registrar, Inc. on February 24, 2016, though recent activity suggests repurposing for malicious operations. The domain resolves to IP address 64.29.17.131, hosted within AS16509 (Amazon.com, Inc.) in the United States. Security vendors have flagged this domain with 20 detections out of 95 on VirusTotal, while it appears on two security blocklists and is actively blocked by PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WR1), which, while legitimate, does not mitigate the underlying phishing threat. Mitigation steps for this specific threat type include immediate domain blacklisting at the network perimeter, particularly for financial institutions and corporate environments. Endpoint protection systems should be updated to recognize the domain and its associated IP as malicious. Security teams are advised to conduct a retrospective analysis of network logs for connections to 64.29.17.131 or the domain within the past 30 days, focusing on credential submission events. User awareness training should emphasize verification of banking portals through official channels, particularly for domains hosted on third-party platforms like now.sh. Financial institutions should issue alerts to customers regarding this specific phishing domain and monitor for unusual authentication attempts originating from the identified infrastructure.