sampaworks[.]info

The domain sampaworks.info has been identified as a generic phishing threat that impersonates Sampath Bank, a Sri Lankan financial institution. This domain is currently offline, but during its active period it posed a high risk to users who may have encountered a fraudulent login page designed to steal credentials. The page title 'Sampath Gampathige' further indicates the impersonation of the bank's brand.

Technical analysis reveals that this domain was created on July 26, 2025, and registered through NameCheap, Inc. It resolves to IP address 209.74.67.51, which is associated with a hosting provider often abused for malicious activities. The domain is flagged by 19 out of 95 security vendors on VirusTotal, indicating widespread detection. It also appears on three security blocklists and has been found in 50 threat intelligence pulses on AlienVault OTX. The SSL certificate is issued by Sectigo Limited, which is a legitimate certificate authority, but the certificate alone does not guarantee safety.

Since the domain has been taken offline, immediate phishing risk is mitigated, but users should remain vigilant. Anyone who may have interacted with this domain should change their passwords for Sampath Bank accounts immediately and monitor for suspicious activity. For ongoing protection, always verify unknown domains on PhishDestroy before entering sensitive information.