onlineallianceinterna[.]org

The domain onlineallianceinterna.org was registered on March 11, 2026 through Ultahost, Inc. It uses the authoritative name servers ns1.ultahost.com through ns4.ultahost.com and resolves to the IPv4 address 159.100.6.19, which is announced by AS214036 in Germany. The site is served over HTTPS with a Let’s Encrypt R12 certificate, indicating a recent, automated TLS deployment. A visual inspection of the landing page returns HTTP 200 and the HTML title “Home – Alliance International Bank”, a clear attempt to mimic the legitimate Alliance International Bank brand while the underlying target is the cryptocurrency platform Linea. The page is built with Bootstrap, LiteSpeed, jQuery UI, jQuery CDN, jQuery, FancyBox, Popper and supports HTTP/3, all common components of low‑cost phishing kits. The presence of a generic bank‑related title and the explicit impersonation of Linea suggest a credential‑harvesting campaign aimed at users of both the bank and the blockchain service. Reputation services rate the domain extremely poorly. Gridinsoft assigns a trust score of 1 out of 100, and VirusTotal records five positive detections out of ninety‑five scanners. The domain appears on a single security blocklist and is actively listed by PhishDestroy, confirming that defensive feeds consider it malicious. The risk rating is high and the site remains active as of the report date, indicating ongoing operation. Open questions include the exact phishing kit version and whether the domain is part of a broader infrastructure sharing the same hosting provider. Analysts should monitor DNS changes for the four Ultahost name servers and consider adding 159.100.6.19 to network blocklists. Endpoint security policies should be updated to flag any URLs containing the domain or the “Alliance International Bank” title. User awareness campaigns targeting Linea and Alliance International Bank customers are advised to reduce the likelihood of credential compromise.