northwelltrust[.]info

Analysis indicates that the domain northwelltrust.info was registered on 21 February 2026 through the registrar Ultahost. The authoritative nameservers ns1‑ns4.ultahost.com resolve the domain to the IPv4 address 159.100.6.19, which belongs to the German autonomous system AS214036 owned by Ultahost, Inc. The host does not present an SSL/TLS certificate, meaning all HTTP traffic would be unencrypted. A public page title retrieved before the site was taken offline reads “Home – NorthWell Trust”, but no further content has been captured. The domain has been classified as a generic phishing site and is currently listed as offline.

Reputation services show a Gridinsoft trust score of 1 out of 100, indicating extreme distrust. VirusTotal reports that seven of ninety‑three scanning engines flag the domain as malicious, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have already added it to their deny lists. The combination of a newly created domain, low trust score, lack of TLS, and multiple detections suggests an active phishing infrastructure targeting users who might be lured by the “NorthWell Trust” branding. However, the exact phishing payload, credential‑stealing pages, or victim interaction flow have not been observed, leaving the specific attack vector uncertain.

Defenders should continue to block northwelltrust.info at network perimeter and DNS resolvers, monitor for any resurgence of the IP address or related Ultahost nameservers, and consider adding the domain to internal blacklists. Incident response teams should treat any login or credential submission attempts to this domain as compromised and advise affected users to change passwords and enable multifactor authentication. Ongoing threat‑intel feeds should be consulted for potential re‑hosting attempts, as the underlying hosting provider may be reused for future campaigns.