trustbank[.]club

PhishDestroy identifies trustbank.club as an active banking phishing domain designed for credential theft, impersonating legitimate banking services to harvest user login data. This domain exhibits clear hallmarks of a phishing operation, including urgency-driven lures (e.g., fake security alerts or account suspension notices) and fraudulent login portals designed to mimic authentic banking interfaces. While no crypto-drainers or advanced drainer kits are detected in current telemetry, the site’s primary objective remains the exfiltration of banking credentials, making it a high-risk threat vector for financial account compromise. The infrastructure supporting this campaign is provisioned with a professional-grade SSL certificate issued by Google Trust Services, lending an air of legitimacy that increases victim trust and lowers security skepticism.

This domain was flagged on March 20, 2026, the same day it was registered through Global Domain Group LLC. VirusTotal currently shows 0 detections out of 95 engines, indicating a low antivirus coverage rate despite ongoing malicious activity. The domain resolves to IP address 188.114.97.3, a known bulletproof hosting provider frequently abused by phishing actors to evade takedowns. The SSL certificate issued by Google Trust Services does not correlate with the actual entity and appears to be leveraged for domain validation only. As of this report, this domain remains unlisted on major blocklists including Google Safe Browsing and PhishTank, which increases its potential reach and reduces proactive blocking by security tools. The combination of a newly registered domain, low detection rate, and absence from blocklists creates a high-risk exposure window.

As of this investigation, trustbank.club remains active and under active monitoring. Immediate remediation actions include domain blacklisting at the DNS and network levels, browser-based blocklisting via Google Safe Browsing integration, and coordination with hosting provider Global Domain Group LLC for takedown. Financial institutions and security teams are urged to flag this domain in email gateways and to educate users about the risks of entering credentials into unsolicited banking portals. While the current risk level is classified as 'under_investigation,' the lack of detections and blocklist coverage suggests a latent but imminent threat to banking customers. Continued monitoring is required to detect any shift toward deployment of crypto-drainers or lateral movement into other brand impersonations. The final risk classification will be updated following takedown verification and additional telemetry analysis.