credexbnk[.]com

This domain is flagged for elevated-risk brand impersonation, specifically targeting Across Bank customers through deceptive infrastructure and content. Analysis indicates the site was designed to mimic a legitimate financial institution, likely to facilitate credential theft or unauthorized transactions. The threat type is classified as brand impersonation, a tactic commonly used to exploit trust in established banking brands. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain credexbnk.com resolves to IP address 198.251.88.162 and was registered on March 23, 2025, through Dynadot LLC. Security vendors on VirusTotal flagged the domain at a rate of 4/95, while Gridinsoft and Scamadviser assigned trust scores of 0/100 and 1/100, respectively. The domain appears on one security blocklist and was previously blocked by PhishDestroy. Detected technologies include Bootstrap, LiteSpeed, Smartsupp, Slick, jQuery UI, jQuery, Font Awesome, and HTTP/3, alongside a Let's Encrypt SSL certificate. The page title, 'Credex Bank,' directly mirrors the branding of Across Bank, reinforcing the impersonation scheme. Mitigation steps for this specific threat type include immediate domain takedown requests to the registrar and hosting provider, along with blacklisting the IP address 198.251.88.162 across security gateways. Financial institutions and users should be alerted to the impersonation attempt, with advisories to verify domain authenticity before entering credentials. Organizations should monitor for similar domains registered through Dynadot LLC or resolving to the same IP range, as these may indicate coordinated campaigns. End-users are advised to enable multi-factor authentication and scrutinize SSL certificates, particularly those issued by Let's Encrypt for newly registered domains, to avoid falling victim to brand impersonation attacks.