Report Finds 1,465 Phishing Detections Targeting U.S. Energy Brands in 2025

Sep 11, 2025 · Original article ↗

Summary

Hunt.io reports over 1,465 phishing detections targeting the energy sector, including impersonation of Chevron, ConocoPhillips, PBF Energy and Phillips 66. Attackers cloned sites to steal credentials and promote investment scams, while many domains drew few vendor dete

Key points

Hunt.io recorded more than 1,465 energy-sector phishing detections over the past year across 30 brands.
Chevron was the most targeted company in the dataset, with 158 impersonating domains in 2025, up from eight in 2024.
Attackers commonly used HTTrack to copy legitimate sites, then added fake registration and login forms to collect credentials and financial details.
Some campaigns paired brand impersonation with investment-scam templates; a PBF Energy-impersonating site used JavaScript to assemble and download a ZIP payload, though the sample was unavailable for analysis.
Detection was inconsistent: several reported domains were flagged by only one or a few of 94 vendors, and one Phillips 66 look-alike was flagged by none.
The report recommends monitoring cloning artifacts and look-alike domains, coordinating faster takedowns, sharing threat intelligence, and strengthening account access with MFA and conditional access.

Article Details

Publisher: Hunt.io
Report Period: 2025; the research also describes activity over the preceding 12 months.
Scope: Phishing targeting U.S. energy-sector brands, with detailed coverage of Chevron, ConocoPhillips, PBF Energy, and Phillips 66.
Sample Size: More than 1,465 phishing detections across 30 distinct energy-sector brands; the report focuses on four companies.
Key Statistics: Hunt.io reported more than 1,465 phishing detections linked to the energy sector over the preceding 12 months.
The platform recorded 30 distinct energy-sector brands exploited by threat actors.
Chevron impersonation detections rose from 8 unique domains in 2024 to 158 in 2025.
Reported vendor detections ranged from 0/94 for phillips66-carros[.]site to 9/94 for conocophillips[.]live.
Recommendations: Track new look-alike domains using favicon hashes, HTTrack comments, and matching page-title strings.
Establish registrar- and hosting-provider escalation playbooks for rapid takedowns.
Monitor for cloned investor-relations sections, exposed /investors/ directories, and HYIP-style stock portals.
Create SIEM/SOAR rules for recurring artifacts such as the Chevron favicon MD5, /inc/register paths, and HTTrack comments.
Apply MFA and conditional access to energy-sector portals and investor platforms.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`advancedownloads[.]com`	Phishing domain mimicking PBF Energy; the report describes an injected script that attempted to deliver a ZIP payload.
DOMAIN	`cclresources[.]com`	Fake site impersonating Chevron, with cloned investor content and credential-harvesting paths.
DOMAIN	`chevroncorpstocks[.]com`	Phishing domain impersonating Chevron with cloned investor pages and credential-harvesting paths.
DOMAIN	`chevroncvxstocks[.]com`	Phishing domain impersonating Chevron; the report says it hosted a cloned site with fraudulent registration and login forms.
DOMAIN	`conocophillips[.]live`	Phishing domain impersonating ConocoPhillips with a cloned site and credential-harvesting forms.
DOMAIN	`conocophils[.]com`	HTTrack clone of ConocoPhillips' operations page; its registration page was identified as collecting user information.
DOMAIN	`humanenergy-company[.]com`	Phishing infrastructure hosting cloned Chevron investor content and forms that sent data to the attacker-controlled site.
DOMAIN	`pbfenergy[.]cc`	Phishing domain identified as impersonating PBF Energy.
DOMAIN	`phillips66-carros[.]site`	Phishing domain identified as impersonating Phillips 66.
DOMAIN	`phillips66lubricants[.]ru`	Identified as a domain mimicking Phillips 66 for phishing activity.
DOMAIN	`phillips66shop[.]com`	Identified by HuntSQL as a phishing domain impersonating Phillips 66.
DOMAIN	`xn--conocopillips-2z0g[.]com`	Punycode phishing domain identified as impersonating ConocoPhillips.
HOSTNAME	`humanenergy-company[.]com[.]cargoxpressdelivery[.]com`	Reported as a live HTTrack-based phishing clone of Chevron's website.
HOSTNAME	`www[.]humanenergy-company[.]com[.]cargoxpressdelivery[.]com`	Reported as a live HTTrack-based Chevron clone containing credential-harvesting lures.
IPV4	`15[.]197[.]148[.]33`	IP reported as resolving for the ConocoPhillips-impersonating Punycode domain and associated with numerous impersonation domains and malicious activity.
IPV4	`172[.]245[.]14[.]131`	Hosting IP for the Chevron-impersonating phishing domain chevroncvxstocks[.]com.
IPV4	`195[.]35[.]60[.]66`	Hosting IP for the reported phillips66-carros[.]site phishing domain.
IPV4	`3[.]33[.]130[.]190`	IP reported as resolving for the ConocoPhillips-impersonating Punycode domain and associated with numerous impersonation domains and malicious activity.
IPV4	`68[.]65[.]122[.]139`	Reported hosting IP for the Chevron-impersonating site cclresources[.]com.
IPV4	`82[.]197[.]83[.]57`	Hosting IP for the reported conocophillips[.]live phishing site.
IPV4	`92[.]112[.]189[.]173`	Hosting IP for the reported conocophils[.]com phishing site.
IPV4	`94[.]23[.]160[.]111`	Hosting IP for the reported Chevron-impersonating phishing clone on cargoxpressdelivery[.]com.
MD5	`6296ae44fae279994f4b127bd08db3e1`	Chevron favicon MD5 reused across reported phishing clones; the report recommends it as a detection artifact.
URL	`hxxp[:]//cclresources[.]com/`	Reported as additional infrastructure linked to Chevron impersonation campaigns.
URL	`hxxp[:]//chevroncorpstocks[.]com/`	Reported URL for the Chevron-impersonating phishing site.
URL	`hxxp[:]//conocophillips[.]live/`	Reported URL for the ConocoPhillips-impersonating phishing site.
URL	`hxxp[:]//pbfenergy[.]cc/`	Reported URL for the PBF Energy-impersonating phishing site.
URL	`hxxps[:]//conocophils[.]com/register`	Registration URL on the ConocoPhillips-impersonating site, identified as collecting user information.
URL	`hxxps[:]//phillips66-carros[.]site/`	Reported URL for the Phillips 66-impersonating phishing site.