trustwellfinancialbank[.]world

The domain trustwellfinancialbank.world is currently active and has been identified as a banking phishing infrastructure. Registration data shows the domain was created on November 03, 2025 through OwnRegistrar, Inc., and it is served by the authoritative name servers dns1.webproserver.com and dns2.webproserver.com. DNS resolution points to a single IPv4 address, 162.245.237.212, which is the sole hosting endpoint observed for this indicator.

The domain appears on one external blocklist; PhishDestroy has listed it as malicious, providing an additional confirmation of its abusive nature. VirusTotal analysis indicates that one out of ninety‑one security vendors submitted a detection for the domain, suggesting that at least one scanning engine has recognized it as suspicious, while the majority of engines have not yet flagged it. No public information is available regarding SSL certificates, HTTP response codes, page titles, or other web‑layer artifacts, and no further intelligence such as OTX tags or additional blocklist entries has been reported.

The limited visibility of the hosting environment and the sparse detection footprint mean that the full scope of the campaign—such as victim targeting, credential harvesting methods, or command‑and‑control pathways—remains uncertain. Defenders should immediately add trustwellfinancialbank.world to network deny lists and endpoint URL filtering rules, monitor DNS queries for the associated name servers and IP address, and consider sinkholing the IP if feasible. Continuous re‑scanning with multi‑vendor services is advised to capture any future changes in detection status, and threat‑intel teams should track any new sightings that might reveal additional infrastructure or payload details.