bmoonlinebanking[.]co[.]com

The domain bmoonlinebanking.co.com has been identified as a banking phishing site specifically targeting BMO Business Banking customers. Analysis confirms this domain as a fraudulent impersonation designed to harvest login credentials, financial details, and sensitive corporate banking information. As of the latest assessment, the domain has been taken offline, though prior activity and infrastructure remain under scrutiny for residual threats. Infrastructure analysis reveals multiple high-risk indicators. The domain was flagged by 16 of 95 security vendors on VirusTotal, indicating broad consensus on its malicious nature. It was registered through Moniker Online Services LLC on March 30, 2026, with an anomalous future creation date suggesting potential domain spoofing or registry manipulation. The domain resolves to the IP address 103.56.84.58, hosted on a server running Ubuntu and Nginx, a common configuration for phishing sites due to its flexibility and low cost. Additional red flags include a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100, alongside its presence on one security blocklist, specifically PhishDestroy. The page title, 'BMO Online Banking for Business | BMO Business Login,' directly mirrors legitimate BMO branding, increasing the likelihood of successful deception. Current status confirms the domain is offline, reducing immediate exposure risks. However, the infrastructure and registration details remain active, posing potential for reactivation or reuse in future campaigns. Organizations and financial institutions are advised to implement proactive measures, including blocking the domain and associated IP address at the network perimeter. End-users should be alerted to verify URLs carefully, particularly for business banking portals, and report any suspicious communications. Monitoring for similar domains registered through the same registrar or resolving to the same IP range is recommended to preempt further fraud attempts. Financial entities should also consider implementing multi-factor authentication and real-time transaction monitoring to mitigate credential theft risks.