finance-novatrustee.site presents itself as "Nova Trustee Bank" and is classified by PhishDestroy as an impersonation phishing page. It targets people looking for a trusted banking or custody service, including those moving crypto into what they believe is a regulated institution. PhishDestroy first flagged it on 2026-10-03. On 2026-10-19 the domain was still alive and redirecting visitors onward.
How the scam works
Fake bank sites borrow the look and vocabulary of a legitimate financial institution so that visitors will open an "account" without checking further. Victims are typically asked to register, hand over identity documents and log in. They are then encouraged to fund the balance by bank transfer or crypto deposit. Money sent to such a platform goes straight to the operators, and any "withdrawal" usually triggers new demands for fees or verification payments that are never refunded. Credentials and ID scans submitted along the way can be reused for account takeover or identity fraud.
Evidence
Seven of 92 VirusTotal engines flagged the domain as of 2026-10-07: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, Netcraft, SOCRadar and desenmascara.me. That is modest coverage, so many browsers and security tools will still let the page load without a warning. Two AlienVault OTX threat pulses reference it, and it is listed on the PhishDestroy blocklist.
Infrastructure
The domain was registered through Spaceship, Inc. on 2026-09-30, only three days before PhishDestroy caught it. That short gap points to a site set up for quick use rather than a long-standing business. It is hosted in the US on the PONYNET network operated by FranTech Solutions. Its certificate is a free, automatically issued Let's Encrypt one, so the browser padlock only means the connection is encrypted and says nothing about whether the "bank" is real.
What to do
If you opened an account here, stop sending money and do not pay any fee to unlock a withdrawal. Report the transfers to your real bank or exchange right away and ask about a recall. Change any password you reused on the site, enable 2FA on your email and financial accounts, and watch for identity misuse if you uploaded documents. Security teams should block finance-novatrustee.site at DNS and proxy level and add the "Nova Trustee Bank" lure to user-awareness alerts. Hunting for other recently registered domains that use the same name is also worthwhile.
DOM Analysisanalyzed 2026年10月9日score 88/1001 brand signal
Submitted URLhttps://finance-novatrustee.site/
Favicon Hash
ICANN OVERSIGHT
認定と RAA の背景
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
