di6y7cb0tkbww[.]cloudfront[.]net

PhishDestroy identifies di6y7cb0tkbww.cloudfront.net as an elevated-risk brand impersonation scam specifically targeting HSBC customers. The site, which posed as an HSBC Premier Checking Account application page, was designed to harvest sensitive financial information from unsuspecting users. This phishing campaign exploited the trust associated with the HSBC brand to deceive victims into submitting their personal and banking details.

Technical analysis reveals several red flags: the domain was flagged by 12 out of 95 security vendors on VirusTotal and appears on 2 security blocklists. It resolves to IP address 108.156.172.120 and uses an SSL certificate issued by Amazon RSA 2048 M01, typical of content delivery networks. Although the domain was created on April 25, 2008, its legitimate appearance belies malicious intent. Google Safe Browsing may not have flagged it at the time of analysis, but the combination of impersonation and high VT detection underscores the threat.

The domain has been taken offline, but users who may have encountered it before takedown should remain vigilant. PhishDestroy recommends that anyone who interacted with this site change their HSBC credentials immediately and monitor accounts for suspicious activity. Always verify the authenticity of banking URLs by typing them directly into the browser rather than clicking links in unsolicited messages.