scotiabank[.]co[.]com

Analysis of scotiabank.co.com indicates a high-risk brand impersonation domain targeting Ankr, a known blockchain infrastructure provider. The domain, registered through Moniker Online Services LLC on August 16, 1997, is currently active and exhibits multiple indicators of malicious activity. Infrastructure analysis reveals the domain resolves to 172.67.177.109, hosted on Cloudflare's network (AS13335) in the United States. Nameservers are configured as ns1.nic.co.com through ns4.nic.co.com, a pattern consistent with bulk-registered phishing domains under the co.com namespace. The page title, 'K88 Scotiabank | Link Vào Trang Chủ K88WIN Mới Nhất,' suggests a gambling or betting theme, which does not align with Ankr's core services, indicating a likely attempt to obfuscate the true nature of the phishing campaign.

The domain is flagged by four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, and holds a Gridinsoft trust score of 0/100. Two of 91 security vendors on VirusTotal detect the domain as malicious. The site employs a 301 HTTP redirect, a common tactic to funnel victims to secondary malicious infrastructure. Technologies detected include WordPress, MySQL, PHP, jQuery, HSTS, and HTTP/3, with Cloudflare providing CDN and security services. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate legitimacy due to the widespread abuse of free SSL certificates by threat actors.

Defenders should treat this domain as active phishing infrastructure, particularly given its association with banking phishing scams as classified in the available intelligence. No evidence confirms whether this domain is part of a broader campaign or operates as a standalone threat. The discrepancy between the domain name (scotiabank.co.com) and the targeted brand (Ankr) suggests either a misconfiguration or deliberate obfuscation.