ecbbank[.]co[.]com

Analysis of ecbbank.co.com, created on August 16, 1997 and registered through Moniker Online Services LLC, shows an active infrastructure that is currently hosting a banking phishing campaign targeting Export Credit Bank. The site returns HTTP 200 and presents the page title "Export Credit Bank | Cross Border Financing," indicating an attempt to masquerade as a legitimate financial service. The domain resolves to IP address 188.114.96.3, which is part of AS13335 owned by Cloudflare, Inc., and the server is located in the United States. DNS resolution uses four nic.co.com nameservers (ns1‑ns4.nic.co.com), and the TLS certificate is issued by Google Trust Services under the WE1 profile, confirming the use of a valid public certificate but offering no assurance of legitimacy.

Technical fingerprinting detected common web stacks including Bootstrap, jQuery, Hostinger, Cloudflare Browser Insights, and HTTP/3, all of which are typical for benign hosting and do not indicate a specialized phishing kit. However, the Gridinsoft trust score of 0 out of 100 reflects a severe lack of reputation. External threat intelligence confirms that the domain is listed on four security blocklists and has been flagged by PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal scans show that 2 of 91 security vendors have flagged the domain, reinforcing the suspicion of malicious intent.

While the exact content of the page beyond the title has not been examined, the combination of a high‑risk classification, active status, low trust score, blocklist presence, and the targeted banking theme warrants immediate defensive action. Organizations should block network resolution to 188.114.96.3, add ecbbank.co.com to URL filtering and email security policies, and monitor for any credential submissions or credential‑stealing traffic associated with the domain.