veritrustbank[.]com

This domain, veritrustbank.com, has been identified as a phishing site engaged in brand impersonation targeting Chase, a major financial institution. The threat type is classified as credential harvesting through fraudulent login portals, designed to deceive users into disclosing sensitive authentication details. As of the latest verification, the domain has been taken offline, though residual risks may persist through cached or archived instances. Analysis indicates the domain was registered through Network Solutions, LLC on December 19, 2025, a date inconsistent with typical legitimate domain creation timelines for established brands. Infrastructure analysis reveals the domain resolved to the IP address 216.198.79.1, associated with AS16509 (Amazon.com, Inc.) and geolocated in the United States. Detection metrics show 18 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appeared on one security blocklist. The absence of an SSL certificate further reduced its legitimacy, as modern financial services universally employ encryption. The page title, 'Chase,' directly mimicked the targeted brand to enhance deception. The domain's current offline status mitigates immediate risks, though organizations and users should remain vigilant. Security teams are advised to update blocklists with the domain and its associated IP (216.198.79.1) to prevent residual exposure. End-users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window, particularly those tied to financial services. Monitoring for follow-up phishing campaigns leveraging similar infrastructure (e.g., adjacent IPs or registrant details) is recommended, as threat actors frequently reuse components across multiple operations.