suntrust-kansai[.]com

Analysis of the domain suntrust-kansai.com indicates it is a high-risk brand impersonation site targeting WordPress users. The domain, registered on November 15, 2021, through Netowl, Inc., resolves to the IP address 162.43.116.92, hosted on infrastructure belonging to Xserver Inc. (AS131965) in Japan. The page title, 'サントラスト – Just another WordPress site,' explicitly references WordPress, aligning with the identified scam type of brand impersonation. The domain is currently offline, but prior intelligence reveals it was flagged by 16 of 95 security vendors on VirusTotal and appears in 15 AlienVault OTX threat intelligence pulses, suggesting prior malicious activity.

Infrastructure analysis shows the domain uses Nginx as its web server technology and is associated with five nameservers (ns1.xserver.jp through ns5.xserver.jp). MX records indicate a single mail exchange host (suntrust-kansai.com with priority 0), which may have been leveraged for phishing or spam campaigns. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites. Google Safe Browsing classified the domain under social engineering, and it is blocked by PhishDestroy, further confirming its malicious nature.

Defenders should treat this domain as compromised and avoid any interaction. The combination of brand impersonation, detection by multiple security vendors, and inclusion in threat intelligence pulses justifies its high-risk classification. While the domain is currently offline, historical data suggests it was actively used for malicious purposes. No further content analysis is available, but the technical indicators strongly support its role in phishing or credential theft campaigns targeting WordPress users.