adpurenestbk[.]com

adpurenestbk.com was registered on 31 March 2025 through Cosmotown, Inc. The authoritative nameservers dns1.lytehosting.com through dns4.lytehosting.com resolve the domain to the IPv4 address 163.61.188.222, which is announced by AS153568 NEW DHAKA HARDWARE and geolocated to the United States. The site presented the page title “Adpurenest Bank” and employed a front‑end stack that included Bootstrap, jQuery, Popper, Slick, Lightbox, Tiny Slider, Smartsupp and the LiteSpeed web server. An SSL certificate issued by Let’s Encrypt (R13) was in place at the time of observation. VirusTotal recorded five detections out of ninety‑five scanned vendors, and the domain is listed on the PhishDestroy blocklist as well as a single additional security blocklist. Mail exchange (MX) records exist with priority 0 pointing to adpurenestbk.com, indicating a possibly configured mail service.

The site was taken offline before the reporting date, and no active HTTP response was observed during the latest scan. Analysis indicates that the infrastructure components and the page title are consistent with a credential‑harvesting operation targeting banking customers, although the specific victim brand is not confirmed beyond the generic “Bank” reference in the title. The presence of multiple client‑side libraries is typical for cloned login portals, but without a live page the exact content cannot be verified. The modest detection count suggests limited distribution, yet the inclusion on PhishDestroy highlights that the domain was recognized by anti‑phishing services.

Defenders should continue to block the domain and the associated IP address at network perimeter devices, add the domain to DNS‑based deny lists, and monitor for any resurgence of the same hosting footprint. Additional scrutiny of traffic to AS153568 and the lytehosting nameservers may reveal related campaigns.