accunt-amex[.]hakubavall[.]com

This domain is flagged as an elevated-risk credential phishing site impersonating American Express to harvest login credentials. Analysis indicates the infrastructure was specifically designed to deceive users of the financial services brand, likely through fraudulent login portals or account verification lures. The domain's configuration and timing align with common phishing campaign tactics observed in financial sector threats. Infrastructure analysis reveals the domain accunt-amex.hakubavall.com was registered through Aceville Pte. Ltd. on December 24, 2025, and resolves to the IP address 23.160.193.24, hosted on AS397270 (NetInformatik Inc.) in the United States. The domain currently lacks an SSL certificate, increasing its detectability as malicious. Security vendors on VirusTotal flagged the domain at a rate of 14/95, and it appears on at least one security blocklist. The domain has since been taken offline, though its prior activity remains a concern for retrospective threat analysis. Mitigation for this specific threat type requires immediate action from financial institutions and end-users. Organizations should implement domain-based email filtering to block messages containing accunt-amex.hakubavall.com or its resolved IP address. Users who may have interacted with the domain should reset their American Express credentials via official channels and enable multi-factor authentication. Security teams are advised to monitor network logs for connections to 23.160.193.24 and review recent account access attempts for signs of compromise. Given the domain's creation date and lack of SSL, additional scrutiny should be applied to similar infrastructure registered through the same registrar or hosted on the same autonomous system.