website-5bdf062f[.]nxk[.]slj[.]mybluehost[.]me

PhishDestroy identifies domain website-5bdf062f.nxk.slj.mybluehost.me as an active generic phishing domain currently under investigation for suspected cryptocurrency-draining operations. The page has not been linked to a specific brand impersonation, but behavioral analysis indicates deployment of a drainer kit designed to siphon wallet assets during transaction approvals. Hosting is provided through MyBluehost’s shared infrastructure, a common vehicle for low-cost, high-volume phishing campaigns aimed at bypassing traditional detection layers. Domain registration records show creation on October 05, 2016, indicating long-term availability rather than a recent bulk registration. The domain resolves to IPv4 address 50.6.245.246, a shared MyBluehost ASN node historically associated with both legitimate and malicious tenants. VirusTotal scanning conducted on receipt of the seed yielded 0 positive detections out of 95 engines as of the last update, underscoring its evasion of signature-based defenses. Domain.com served as the registrar, while a Let’s Encrypt certificate provides an HTTPS facade to increase victim trust. Google Safe Browsing (GSB) status remains unflagged and no public blocklists currently list this domain. These technical indicators collectively suggest a newly active but still largely undetected campaign leveraging aged, reputable hosting to lower suspicion. Current status of the campaign is active and under live monitoring by threat intelligence teams. Immediate response actions include continuous sandbox detonation, YARA rule refinement, and targeted takedown outreach to Domain.com and MyBluehost abuse desks leveraging PhishDestroy evidence. Despite these efforts, the domain retains a high residual risk due to its low VT score, lack of GSB block, and the common practice of rapid domain cycling used by operators to evade enforcement. Users are advised to block the domain at the network perimeter and avoid visiting website-5bdf062f.nxk.slj.mybluehost.me until confirmed safe. PhishDestroy seed 0e858d tracks this campaign for ongoing correlation.