en[.]bankocc[.]ru

Analysis of en.bankocc.ru shows active infrastructure designed for a banking phishing campaign. The site returns HTTP 200 and presents the page title "BANKOMAT," a term commonly associated with cash‑dispensing services, suggesting a financial‑themed lure. The server runs PHP behind DDoS‑Guard protection, and the domain resolves to 185.178.208.157, an IP owned by AS57724 DDOS‑GUARD LTD in Russia. The TLS certificate is issued by Let's Encrypt (R13), indicating standard automated issuance without additional validation.

Domain registration occurred on 21 February 2026 via RU‑CENTER‑RU, and the nameservers are ns1.ddos-guard.net and ns2.ddos-guard.net, reinforcing the reliance on DDoS‑Guard infrastructure. Reputation data is unfavorable: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one known blocklist, with PhishDestroy already marking it as blocked. VirusTotal reports nine of ninety‑three scanning vendors flagging the domain, providing independent confirmation of malicious intent. The combined evidence—active status, phishing‑type classification, low trust score, vendor detections, and blocklist presence—indicates a high‑risk profile.

Defenders should block both the domain and its resolved IP at perimeter firewalls, update URL filtering lists to include the domain, and monitor for any outbound connections to the associated IP range. Incident response teams should treat any credentials submitted to this site as compromised, enforce credential resets for affected accounts, and consider user awareness campaigns targeting similar banking‑phishing vectors. Continuous monitoring of the DDoS‑Guard nameserver space is advised, as the infrastructure may host additional malicious sites.