amexo[.]cocolozas[.]com

This domain is flagged as a credential harvesting phishing site targeting users through impersonation of legitimate services. Analysis indicates a high likelihood of malicious intent, with infrastructure designed to capture login credentials, payment details, or other sensitive personal data. The threat type is classified as generic_phishing with an elevated risk level due to its active exploitation potential and lack of mitigating trust signals. Infrastructure analysis reveals the domain amexo.cocolozas.com resolves to the IP address 23.160.193.24, hosted on AS397270 (NetInformatik Inc.) in the United States. It is registered through Aceville Pte. Ltd., with a creation date of December 25, 2025, suggesting a recently established malicious operation. The domain appears on one security blocklist and is flagged by 18 out of 95 security vendors on VirusTotal, indicating broad detection but not yet universal coverage. No SSL certificate is present, increasing the risk of unencrypted data interception. The page title, matching the domain name, further suggests a lack of effort to mimic a legitimate service, relying instead on deceptive URLs or social engineering tactics. Mitigation requires immediate blocking of the domain and its associated IP address (23.160.193.24) at the network perimeter. Security teams should deploy signatures to detect and prevent access attempts, particularly in environments where users may be targeted via phishing emails or malicious redirects. Endpoint protection should be updated to include the domain in real-time blacklists, and users should be educated on recognizing phishing indicators, such as missing HTTPS, unusual domain structures, and mismatched branding. Given the domain's current offline status, monitoring for re-emergence or related infrastructure (e.g., newly registered domains under the same registrar or IP range) is recommended to preempt further campaigns.