legacytrustbank[.]com

Analysis of legacytrustbank.com shows a high‑risk brand‑impersonation campaign targeting the foundation brand through a banking‑phishing front. The domain was registered on 13 January 2025 via Gname.com Pte. Ltd. and is hosted on an IP address (107.173.193.235) owned by AS36352 HostPapa in the United States. The site returns an HTTP 302 redirect and presents a Let's Encrypt certificate (E8) with no apparent trust, reflected in a Gridinsoft trust score of 0 / 100. Infrastructure clues include nameservers ns1.ltxcloud.com and ns2.ltxcloud.com, and the domain currently appears on one security blocklist and is flagged by PhishDestroy. VirusTotal scans have identified malicious activity in three of ninety‑five engines, reinforcing the phishing classification. The page title “Legacy Trust Bank” suggests an attempt to masquerade as a legitimate financial institution, and the threat is labelled as Banking Phishing with impersonation of the foundation brand. While the exact content of the landing page has not been examined, the combination of redirection, low trust score, and partial VirusTotal detections justify a high‑risk rating. Defenders should block DNS resolution to 107.173.193.235, add legacytrustbank.com to URL filtering and email security policies, monitor outbound connections for similar AS36352 hosts, and consider sharing the indicator set with threat‑intel platforms. Ongoing observation is advised to detect any changes in hosting or additional malicious payloads.