crestlinetrust[.]com

Analysis of crestlinetrust.com indicates a confirmed phishing infrastructure impersonating Crestline Trust Bank, active as of July 25, 2026. The domain was registered on February 21, 2026, through HOSTINGER operations, UAB, and currently resolves to IP address 172.93.120.110, hosted on AS393960 (Host4Geeks LLC) in the United States. The site returns an HTTP 302 redirect status, a common technique to obscure final phishing page destinations or evade detection. The page title, 'Home - Crestline Trust Bank,' explicitly signals intent to mimic the legitimate financial institution, though no further content analysis has been conducted to confirm specific phishing kit components or credential harvesting mechanisms.

Infrastructure analysis reveals the domain is served by nameservers ns1.spantrix.com and ns2.spantrix.com, a pattern observed in other phishing campaigns. The SSL certificate is issued by Let's Encrypt (YE2), providing encryption without identity validation, a frequent choice for malicious sites. Detection data shows the domain is flagged by five of 93 security vendors on VirusTotal and appears on at least one security blocklist (PhishDestroy). Trust scores from Scamadviser (7/100) and Gridinsoft (0/100) further corroborate its malicious classification.

Defenders should treat crestlinetrust.com as an active, high-risk phishing domain targeting Crestline Trust Bank customers. The combination of recent registration, financial-themed branding, low trust scores, and multi-vendor detection strongly supports immediate blocking at network and endpoint layers. While the exact phishing kit or payload remains unconfirmed, the observable infrastructure and detection signals align with credential theft operations. Organizations are advised to monitor for related domains using the same nameservers or hosting provider, as these may indicate broader campaign infrastructure.