ubofs[.]com

The domain ubofs.com has been identified as an active phishing site, posing as the Ulster Bank of Scotland. Registered through TuringSign Inc. d/b/a Cosmotown on January 18, 2022, the domain's infrastructure includes technologies such as Apache HTTP Server, Modernizr, jQuery Migrate, jQuery, FlexSlider, and FancyBox. The use of a Let's Encrypt SSL certificate suggests a level of legitimacy; however, this is commonly used by malicious actors to disguise their intentions. The domain resolves to the IP address 51.68.176.163, which has not been flagged for suspicious activity in isolation but should be considered in context with its association to this phishing operation. The current status of the domain remains active, indicating that it is still functioning as a phishing site targeting users of the reputable banking institution.

Analysis indicates that ubofs.com has been flagged by multiple security vendors, with 11 out of 95 on VirusTotal marking the domain as suspicious. Additionally, it has been recorded in 25 threat intelligence pulses on AlienVault OTX and appears on two distinct security blocklists. These data points provide compelling evidence of the domain's malicious nature and highlight its continued operation within the phishing landscape. The Gridinsoft trust score of 0 out of 100 further underscores the risks associated with this domain.

Defenders should remain vigilant regarding communications that might direct users to ubofs.com or similar domains. It is crucial for organizations to educate their users about the dangers of phishing and to implement robust email filtering solutions to mitigate the risks associated with this and other phishing attempts. Continuous monitoring of threat intelligence feeds that list ubofs.com will help in validating its threat level and creating timely responses to any potential compromises.