crowntr[.]builltt[.]com

Analysis of the domain crowntr.builltt.com indicates it was actively impersonating the financial brand 'across' as of July 23, 2026. The domain, registered on September 26, 2025, through Dynadot LLC, resolved to IP 198.23.193.170 (AS36352 HostPapa, US) and was served via nameservers dns1.geebytesdns.com and dns2.geebytesdns.com. No SSL certificate was present, increasing the risk of unencrypted data transmission. The page title, 'Crownt Trust - Dedicated to innovating, simplifying, and humanizing digital banking,' closely mirrors branding language associated with financial institutions, though the exact content and functionality of the site remain unconfirmed due to its offline status.

Detection data reveals the domain was flagged by 13 of 95 security vendors on VirusTotal and appeared on a single blocklist (PhishDestroy). Trust scores from Scamadviser (34/100) and Gridinsoft (0/100) further indicate malicious intent. Technologies detected on the domain included Bootstrap, LiteSpeed, GSAP, Smartsupp, OWL Carousel, and jQuery, alongside HTTP/3, suggesting a structured phishing kit rather than a hastily assembled page. The domain was classified as a brand impersonation scam, though the specific tactics (e.g., credential harvesting, fraudulent transactions) are not detailed in available intelligence.

Defenders should treat this domain as high-risk infrastructure. The absence of SSL, low trust scores, and vendor detections justify blocking the domain and its resolving IP at the perimeter. Monitoring for re-registration or reuse of the same nameservers (dns1/dns2.geebytesdns.com) may help identify related campaigns. Given the domain's offline status, further forensic analysis is not currently possible, but historical logs should be reviewed for interactions with 198.23.193.170 or the domain itself prior to its takedown.