serturnglob[.]com[.]epicmentis[.]com

serturnglob.com.epicmentis.com was observed hosting a page titled “Saturn Global Bank‑ Your New Favorite Bank”. The page title suggests an attempt to impersonate a financial institution named Saturn Global Bank, although no additional branding or login interface has been captured. The domain was registered on 21 February 2026 and is currently taken offline. An SSL certificate identified as “R12” was presented at the time of collection, indicating the use of a publicly‑trusted certificate rather than a self‑signed or expired one.

The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing service has flagged it. VirusTotal recorded scans from 93 independent scanners; none reported malicious behavior, a result that reflects the current lack of detections rather than confirmation of safety. The limited visibility—absence of known IP address, hosting details, or registrar information—prevents a deeper infrastructure attribution.

Because the site is offline, active exploitation cannot be confirmed, but the combination of a targeted page title, recent registration, and blocklist inclusion aligns with a typical generic phishing deployment. Defenders should continue to block the domain at perimeter and DNS layers, monitor for re‑appearance, and consider adding the indicator to internal threat‑intel feeds. Ongoing observation is recommended until the investigation concludes, as future activity or additional detections could alter the risk posture.