excreditonline[.]com

Analysis shows that excreditonline.com is an active generic phishing domain flagged as high risk. The site resolves to IP 163.61.188.222, which is hosted in the United States under AS153568 NEW DHAKA HARDWARE. The domain was registered on May 06, 2025 through Cosmotown, Inc., and uses the nameservers dns1.lytehosting.com through dns4.lytehosting. It serves content over HTTPS using a Let’s Encrypt certificate (R13) and returns HTTP 200 responses. The page title "Excredit Online - BANK" suggests a credential‑stealing campaign targeting banking users. Infrastructure details reveal a low Gridinsoft trust score of 1/100, presence on one security blocklist, and a block entry by PhishDestroy. VirusTotal records two detections out of ninety‑five scanners, indicating limited but existing vendor awareness. Detected web technologies include Bootstrap, LiteSpeed, SweetAlert2, SweetAlert, Smartsupp, jQuery, FancyBox, and HTTP/3, which are common in phishing kits. Current intelligence does not provide a detailed content snapshot beyond the title, so the exact phishing payload remains unconfirmed. Defenders should treat the domain as malicious, enforce blocklist rules to deny any network traffic to the associated IP and domain, and consider adding the domain to internal threat feeds. Continuous monitoring of the IP address for new activity and periodic re‑scans with multi‑engine services are advised to capture any changes in detection status.