scotia-connect[.]co[.]com

Analysis of scotia-connect.co.com, observed as a social media phishing infrastructure targeting Facebook users, indicates a high‑risk profile. The domain resolves to the IPv4 address 193.46.217.224, which is associated with AS400992 ZhouyiSat Communications in the United States. The hosting IP appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple threat‑intelligence feeds have flagged the same host. Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting a lack of credibility.

VirusTotal data shows that 14 of 95 scanned security vendors flagged the domain, further corroborating malicious activity. The domain was originally registered on August 16, 1997 through Moniker Online Services LLC and continues to use the default .co.com name‑server set (ns1.nic.co.com through ns4.nic.co.com). No TLS certificate is presented, meaning traffic is unencrypted and vulnerable to interception. The page title retrieved from the site—"Scotia Connect - Official Website - Login"—does not reference the targeted brand, yet the intelligence explicitly lists Facebook as the impersonated brand, classifying the operation as a social media phishing campaign.

The site is currently offline, but the underlying infrastructure remains reachable via its IP address. Defenders should continue to block the domain and associated IP at perimeter filters, propagate the observed blocklist indicators, and monitor for any re‑activation or reuse of the same hosting resources. Threat‑intel platforms should update their feeds with the observed detection count, blocklist entries, and trust‑score rating to improve future detection.