rewardss[.]makeup

This domain is flagged as a high-risk credential phishing site specifically targeting customers of Bank of the Philippine Islands (BPI). Analysis indicates the site mimics the legitimate BPI login portal, as evidenced by the page title 'Bank of the Philippine Islands | BPI,' with the intent to harvest banking credentials and personal financial information. Infrastructure analysis reveals the domain was registered on May 31, 2026, through Hefei Juming Network Technology Co., Ltd. It resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) with no SSL certificate present. Detection metrics show 6 out of 95 security vendors on VirusTotal have flagged the domain, while it appears on three distinct security blocklists, including PhishDestroy, MetaMask, and SEAL. The domain's creation date is suspiciously set in the future, a common tactic to evade initial detection and prolong operational lifespan. Mitigation steps for this threat include immediate blacklisting of the domain and associated IP address (188.114.96.3) at the network perimeter. Financial institutions and users should be alerted to verify the authenticity of any communication claiming to originate from BPI, particularly those directing users to login portals. Monitoring for similar domains registered through Hefei Juming Network Technology Co., Ltd. or resolving to Cloudflare-hosted IPs may help identify related phishing infrastructure. Users should be advised to enable multi-factor authentication and report any suspicious login attempts to their financial institution.