guduatabank[.]pro

This domain, guduatabank.pro, is an active phishing site designed to impersonate Gudauate Bank, a financial institution. The threat specifically targets users seeking online banking services, presenting a fraudulent login interface to harvest credentials, payment details, or other sensitive financial information. Analysis of the domain indicates it is engineered to mimic legitimate banking portals, increasing the likelihood of successful deception for unsuspecting victims. Technical evidence confirms the malicious nature of this domain. As of the latest scan, 2 out of 95 security vendors on VirusTotal flag guduatabank.pro as malicious. The domain was registered on March 24, 2026, through eNom, LLC, and is currently blocked by at least one security blocklist (PhishDestroy). Infrastructure analysis reveals the domain resolves to the IP address 198.251.84.200, hosted on AS53667 FranTech Solutions in the United States. The site employs a Let's Encrypt SSL certificate (YR2), which, while providing encryption, does not validate the legitimacy of the domain. Users who have visited guduatabank.pro or entered credentials on the site should take immediate action to mitigate risk. First, cease all interaction with the domain and avoid clicking any links or downloading files from it. If credentials were entered, affected users must change their passwords for the legitimate banking portal and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all financial accounts as an additional security layer. Monitor bank statements and transaction histories for unauthorized activity, and report any suspicious transactions to the legitimate financial institution. Organizations should update their security blocklists to include this domain and its associated IP address to prevent further access.