usabankonline[.]com

Analysis of the domain usabankonline.com indicates an active infrastructure supporting a banking‑phishing campaign. The domain was registered on 21 February 2026 through Squarespace Domains II LLC and resolves to the IPv4 address 157.245.134.88, which belongs to AS14061 DigitalOcean, LLC located in the United States. DNS is served by Google Cloud’s ns‑cloud‑a1, a2, and a3 nameservers, a configuration commonly used by legitimate and malicious actors alike. An HTTPS service is presented with a Let’s Encrypt certificate issued to the short‑lived identifier “E7”, confirming the use of a free SSL provider without a custom CA.

The web server stack includes Nginx with the Nicepage site builder, jQuery, and a reCAPTCHA widget, all delivering a HTTP 200 response and a page title of “Home”. VirusTotal analysis shows that 1 of 93 AV engines flagged the domain, and it appears on three external blocklists, specifically PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score is 0 / 100, reinforcing the malicious classification. The observed indicators collectively point to a high‑risk banking‑phishing operation targeting users of US banking services.

Uncertainties remain regarding the exact login capture mechanism and any additional payloads hosted on the server, as no visual inspection of the page content is available. Defenders should block the domain at DNS and proxy layers, add the IP address 157.245.134.88 to deny‑list rules, and monitor for any outbound connections to the same host. Organizations should also update endpoint protection signatures to reflect the single VirusTotal detection and ensure that web‑filtering solutions incorporate the listed blocklists. Continuous observation of the domain’s DNS changes and any new certificate issuance is advised, as the infrastructure could be repurposed or expanded.