app[.]pvtcredun[.]com

Analysis of app.pvtcredun.com indicates a newly registered infrastructure used for brand impersonation and crypto‑related fraud. The domain was created on February 21, 2026 and resolves to IP address 198.23.141.202, which belongs to AS36352 operated by HostPapa in the United States. The hosting provider is a shared‑hosting service often abused for short‑lived malicious sites. The site presented a page titled "Primevault Credit Union - Dedicated to innovating, simplifying, and humanizing digital banking," suggesting an attempt to mimic a legitimate financial institution.

The SSL certificate is identified as version R10, providing encrypted transport but offering no assurance of legitimacy. VirusTotal scans show that two of ninety‑three security vendors flagged the domain, corroborating its malicious nature. The domain appears on a single blocklist, PhishDestroy, which has taken the site offline. The risk level is marked elevated, and the current status is offline, indicating that active hosting has been terminated or blocked.

While the page title reveals the targeted brand, the underlying content, login forms, or credential‑stealing mechanisms have not been captured, leaving those details uncertain. Defenders should block traffic to the domain and its associated IP, monitor for any re‑registration attempts, and update detection signatures to include the observed SSL fingerprint and host header. Continuous observation of HostPapa’s IP range for similar rapid‑creation domains is recommended to pre‑empt further impersonation campaigns.