msbank[.]pro

On 24 July 2026, the domain msbank.pro was observed as part of an elevated‑risk banking phishing campaign. The zone was registered through Global Domain Group LLC on 22 March 2026, using the authoritative name servers ns1.globaldomaingroup.com and ns2.globaldomaingroup.com. DNS resolution points to the IP address 193.181.214.73, which belongs to Webdock.io ApS in Denmark. The host serves content over HTTPS with a Let’s Encrypt certificate (issuer E8) and returns an HTTP 503 status code, indicating the service is currently unavailable. Technical fingerprinting reveals a stack comprising Node.js, React, Nginx, Next.js and Webpack, suggesting a modern web application framework was employed during the brief live period.

VirusTotal analysis recorded 15 detections out of 94 scanned security vendors, confirming malicious intent. The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy feed. Independent reputation scoring from Gridinsoft assigns a trust score of 0 / 100, reinforcing the hostile classification. The page title returned by the server is “United Mississippi Bank – Premium Banking Reimagined,” directly referencing the targeted financial institution and confirming the campaign’s intent to impersonate that brand.

At the time of reporting the site is offline, limiting immediate observation of payloads or credential‑capture mechanisms. Consequently, the exact phishing kit, form fields, or redirect behavior remain unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the same IP or name‑server pair, and add the host to internal blocklists. Incident response teams should also watch for any emails or messages that reference the United Mississippi Bank branding, especially those that direct victims to the now‑inactive msbank.pro URL, as threat actors may repurpose the same social‑engineering content on new infrastructure.