heritagefbk[.]com

Analysis indicates that heritagefbk.com is actively hosting a generic phishing page, as evidenced by a page title referencing "Heritage First - Dedicated to innovating, simplifying, and humanizing digital banking" and an HTTP 200 response. VirusTotal has flagged the domain in 14 of 95 security vendor scans, and it is currently listed on a security blocklist and blocked by PhishDestroy. The site’s technical stack includes Nginx and OpenResty, and it presents a valid Let's Encrypt certificate issued under the R13 profile.

Infrastructure assessment reveals that the domain resolves to IP address 159.100.6.5, which geolocates to Germany and is owned by UltaHost Inc. The domain was registered on April 11, 2025 through Ultahost, Inc., and utilizes four authoritative nameservers (ns1‑ns4.ultahost.com). The Gridinsoft trust score of 0 out of 100 further underscores the malicious nature of the host. MX records point to the same domain, suggesting potential use for email-based phishing delivery.

While the page title and technical fingerprints confirm the presence of a phishing operation, the specific content of the landing page, credential capture mechanisms, and any associated command‑and‑control infrastructure have not been publicly disclosed. Consequently, the full scope of the campaign, including whether this domain is part of a broader network of impersonated financial services, remains uncertain.

Defenders should prioritize immediate mitigation actions: block heritagefbk.com at DNS and proxy layers, add the associated IP 159.100.6.5 to network‑level deny lists, and ensure email security gateways flag any messages originating from the domain or its MX record. Continuous monitoring of UltaHost‑registered domains and the identified nameserver set is advised, as similar patterns may emerge in future phishing deployments.