optionaccounting[.]com

Analysis conducted on July 23, 2026 identifies optionaccounting.com as a credential phishing infrastructure targeting banking credentials. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to IP 149.50.97.159, which belongs to AS201814 MEVSPACE sp. z o.o. in Poland. The authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. No TLS certificate was observed, indicating HTTP-only service at the time of capture.

The page title returned by the HTTP request is simply “optionaccounting.com”, and the site has been taken offline, as confirmed by the current status flag. The domain appears on a single security blocklist and has been blocked by the PhishDestroy filtering service. VirusTotal scanned the host and three of ninety‑three AV engines flagged the domain as malicious, providing additional corroboration of its phishing nature. The listed scam type is Banking Phishing, suggesting that actors intend to harvest credentials for online banking services. However, the exact phishing kit, credential‑harvesting page structure, and targeted brand are not disclosed in the available data, leaving those aspects uncertain.

Defenders should add the domain and its associated IP address to network‑level blocklists, update URL filtering policies, and monitor for any residual traffic to the IP range owned by MEVSPACE. Because the domain lacked an SSL certificate, attempts to enforce HTTPS via HSTS or similar mechanisms can be used to disrupt any future re‑use of the same host name. Continuous re‑scanning of the domain, especially if it reappears, is recommended to capture any changes in detection scores. Organizations should also educate users about the risk of unsolicited banking login requests and advise verification of URLs before entering credentials. The current evidence indicates that optionaccounting.