hsbc[.]ratereset[.]net

This domain, hsbc.ratereset.net, is flagged as an elevated-risk credential harvesting phishing resource. Analysis indicates it specifically targets financial institution credentials through deceptive rate adjustment lures, a common tactic in banking fraud campaigns. The domain's infrastructure and content patterns align with credential theft operations, where victims are tricked into submitting login details on fraudulent interfaces mimicking legitimate financial services. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to IP address 40.117.181.212, hosted on infrastructure belonging to AS8075 (Microsoft Corporation) in the United States. It was registered through GoDaddy.com, LLC on February 23, 2026, with a suspicious future creation date suggesting potential domain age manipulation. The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2. Detection metrics show 12 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The page title 'Rate Reset' confirms the phishing theme, designed to exploit customers expecting legitimate rate adjustment communications. Organizations and individuals should implement specific mitigation measures against this credential harvesting threat. Network-level protections should block both the domain hsbc.ratereset.net and its resolving IP 40.117.181.212 at perimeter security controls. Security teams should monitor for connections to this infrastructure and investigate any internal systems that may have interacted with it. User awareness training should emphasize verification of unexpected rate adjustment communications, particularly those requesting credential submission. Financial institutions should proactively notify customers about this specific phishing campaign and reinforce secure authentication procedures for rate-related transactions.