encora[.]one

The domain encora.one is currently listed as an active generic phishing site. Infrastructure analysis shows it is registered through Dynadot Inc and resolves to the authoritative name servers ns1.oh313.parklogic.com and ns2.oh313.parklogic.com. The domain appears on a single public security blocklist and is actively blocked by the PhishDestroy feed, indicating that at least one threat‑intelligence source has identified malicious intent. An HTTP request to the root URL returns a 200 OK status, confirming that a web server is reachable and responding to client connections.

VirusTotal has processed the domain with 91 malware scanners; none of the engines raised a detection at the time of analysis. The absence of detections does not imply that the site is benign, only that automated signatures have not yet flagged the observed content. No additional reputation scores, Safe Browsing alerts, or Open Threat Exchange (OTX) entries were found in the supplied intelligence. Because the site lacks publicly disclosed page titles, SSL certificate details, or IP‑level attribution, many operational attributes remain unknown.

The lack of visible branding or a target organization in the available data prevents a more precise attribution of the phishing campaign. Defenders should treat encora.one as a high‑confidence phishing indicator based on its blocklist presence, active block by PhishDestroy, and reachable HTTP endpoint. Recommended mitigation steps include adding the domain to local deny lists, updating web proxy and firewall rules to block outbound connections, and monitoring DNS logs for any resolution attempts. Continuous re‑assessment is advised, as further analyses may uncover additional artifacts such as malicious payloads, credential‑harvesting forms, or associated command‑and‑control infrastructure.