e-cordillerab[.]com

Analysis of e-cordillerab.com confirms its classification as a phishing domain targeting Cordillera Bank customers. The domain, registered on February 22, 2026, through NiceNIC International Group Co., Limited, currently resolves to the IP address 194.238.57.233, hosted under AS207567 (Intezio Worldwide Limited) in Sweden. Infrastructure analysis reveals the absence of an SSL certificate, a common red flag for phishing sites, as secure banking portals universally employ HTTPS. The page title explicitly displays 'Cordillera Bank,' indicating an attempt to mimic the legitimate institution's branding. Detection data supports the phishing verdict: four of 95 security vendors on VirusTotal flagged the domain, and it appears on one security blocklist (PhishDestroy).

AlienVault OTX includes the domain in a threat intelligence pulse, further corroborating its malicious nature. The domain's trust score of 36/100 from Scamadviser reflects elevated risk, though this metric alone is not conclusive. Nameservers georgy.ns.retry.name and jenny.ns.retry.name are consistent with bulletproof or low-reputation DNS providers often exploited by threat actors. As of July 25, 2026, the domain is offline, likely following takedown efforts or abandonment by the operators.

However, defenders should treat this domain as compromised infrastructure. Network security teams are advised to block the IP 194.238.57.233 and associated nameservers at perimeter defenses. Financial institutions, particularly Cordillera Bank, should monitor for credential reuse or fraud attempts linked to this campaign. Given the domain's recent registration and rapid detection by security vendors, additional related domains may emerge, warranting proactive monitoring of newly registered lookalike domains under the same registrar or hosting provider.