crutrustbank[.]com

Analysis of crutrustbank.com indicates an active high‑risk brand‑impersonation campaign targeting Apple users. The domain was registered on October 03, 2025 by Cosmotown, Inc., and resolves to the IPv4 address 198.23.193.170, which is hosted in the United States under ASN 36352 (HostPapa). The authoritative nameservers listed are dns1.geebytesdns.com, dns2.geebytesdns.com, ns1.geebytescloud.com, and ns2.geebytesclou, confirming the use of the geebytes DNS infrastructure. An SSL certificate issued by Let’s Encrypt with the E7 identifier is active, providing encrypted transport but offering no indication of legitimacy.

The HTTP response returns status code 200, and the page title observed is "Online Banking – Crutrust Bank," consistent with the declared scam type of banking phishing. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the site, and VirusTotal reports that 3 of 95 scanning engines flag the domain as malicious, reinforcing the suspicion of malicious intent. The threat actor explicitly impersonates Apple, leveraging the brand to lure victims into credential harvesting.

While the exact content of the site has not been examined, the combination of a recent registration, low trust score, active SSL, and multiple detection signals suggests the infrastructure is deliberately deployed for phishing. Defenders should immediately add crutrustbank.com to deny lists across firewall, DNS filtering, and email security gateways. Continuous monitoring of the associated IP range (198.23.193.0/24) and the geebytes nameserver set is advised, as the operators may replicate the pattern for additional malicious domains. Organizations with Apple accounts should reinforce user education on verifying legitimate Apple communications and consider deploying multi‑factor authentication to mitigate credential compromise risks.