afmbo-ltd[.]org

afmbo-ltd.org was registered on 2025-10-04 through Global Domain Group LLC and is hosted on the IP address 198.23.193.170, which belongs to AS36352 (HostPapa) in the United States. The domain resolves to four name servers – dns1.geebytesdns.com, dns2.geebytesdns.com, dns1.hostwithmajeek.com and dns2.hostwithmajeek.com – indicating a split‑hosting configuration that may be used to increase resilience. No TLS certificate is presented, meaning the site is served over plain HTTP only, which further reduces the credibility of the page. The HTTP response presents the title “Home | Mobile Banking, Credit Cards, Mortgages, Auto Loan”, suggesting an attempt to imitate a generic online banking portal. The intelligence classifies the activity as a brand‑impersonation scam targeting multiple banking brands, although the specific brand name is not disclosed in the provided data.

VirusTotal analysis shows that three of ninety‑five scanning engines have flagged the domain, reflecting a low but non‑zero detection rate among automated scanners. Independent blocklist monitoring reports that the domain is listed on one security blocklist and has been actively blocked by the PhishDestroy service, indicating that at least one commercial phishing mitigation platform is already taking protective action. Reputation services assign a Gridinsoft trust score of 0 out of 100 and a Scamadviser score of 1 out of 100, both of which are indicative of a malicious or highly suspicious site. The current operational status is recorded as offline, suggesting that the site may have been taken down or is temporarily inaccessible.

However, the underlying infrastructure – the hosting provider, name servers and IP address – remain active and could be reused for future malicious campaigns. Defenders should add 198.23.193.170 to network‑level deny lists, monitor the four name servers for new domain registrations, and continue to block afmbo-ltd.org at DNS, proxy and web‑filter layers.