app[.]berkeleycreditbank[.]com

Analysis indicates that the domain www.app.berkeleycreditbank.com is active and resolves to the IPv4 address 198.251.83.119, which is assigned to AS53667 FranTech Solutions in the United States. The domain was registered on February 21, 2026 through Dynadot LLC and is served by the authoritative nameservers ns25.my-control-panel.com and ns26.my-control-panel.com. The hosting infrastructure presents a LiteSpeed web server fronted by Cloudflare, and the site presents a TLS certificate issued by Let’s Encrypt (R13), confirming that HTTPS is correctly negotiated despite the malicious intent. The page title returned by the HTTP 200 response reads "Personal Banking | Financial Services | Berkley Credit bank", and the technology fingerprint includes Adobe Experience Manager, Java, Bootstrap, as well as third‑party libraries from Unpkg, jsDelivr, and Select2. These indicators are consistent with a typical banking‑phishing kit that emulates a financial institution’s portal.

The domain is explicitly recorded as impersonating Visa, and the scam type is classified as Banking Phishing. Reputation checks show a Gridinsoft trust score of 1 out of 100, placing the domain in the lowest trust tier. VirusTotal analysis flags the domain in 14 of 93 scanned security vendors, reinforcing the malicious classification. The domain is listed on at least one public security blocklist and has been blocked by the PhishDestroy service, demonstrating that existing threat‑intel feeds are already aware of its activity.

Given the combination of a low trust score, multiple vendor detections, active blocklist entries, and the use of a reputable SSL certificate to lend credibility, defenders should treat traffic to this host as high‑risk. Recommended actions include adding the IP address 198.251.83.119 and the fully qualified domain name to firewall deny lists, updating DNS sinkhole configurations, and ensuring endpoint protection solutions ingest the VirusTotal detection count.