nehabk[.]com

Analysis conducted on July 25, 2026 identifies nehabk.com as an offline infrastructure supporting a banking phishing campaign targeting the fictitious “Neha Bank”. The domain was registered on March 11, 2026 through OwnRegistrar, Inc. and resolves to the IPv4 address 192.142.53.193, which is assigned to AS214036 Ultahost, Inc. in the Netherlands. Hosting is provided by a VPS environment using Apache HTTP Server with the Bootstrap front‑end framework, Lightbox, and the Smartsupp live‑chat widget detectable via passive fingerprinting. Authoritative name servers ns5.mywebvps2.com and ns6.mywebvps2.com resolve the domain, indicating reliance on the MyWebVPS2 hosting platform.

No TLS certificate is deployed, meaning traffic would be served over plain HTTP, a common characteristic of low‑cost phishing kits. The page title returned during prior scans reads “Neha Bank - Online Banking”, confirming the intended impersonation of a financial institution. VirusTotal scans report that two of ninety‑five security vendors flagged the domain, and the domain appears on a single public blocklist, where it is listed by PhishDestroy. The current online status is recorded as offline, limiting immediate payload inspection, but historical evidence confirms the site previously hosted phishing content.

Uncertainties remain regarding the exact phishing kit used, credential‑capture mechanisms, and any associated command‑and‑control infrastructure, as no payload samples or sandbox analysis are available. Defensive actions should include adding 192.142.53.193 to network‑level deny lists, blocking the domain at DNS resolvers, and monitoring for new registrations that reuse the “nehabk” lexical pattern. Security teams should also update web‑gateway and endpoint filters with the observed indicators of compromise, including the detected technology stack (Bootstrap, Smartsupp) and the specific page title.