alvracreditunion[.]com[.]ackisaffiliate[.]com

alvracreditunion.com.ackisaffiliate.com is currently listed as offline but retains a set of observable artifacts that merit continued monitoring. The domain was registered on 2024-09-08 through NameCheap, Inc., and resolves to the IP address 198.23.193.170, which is allocated to AS36352 HostPapa in the United States. DNS resolution is handled by ns1.geebytescloud.com and ns2.geebytescloud.com, both of which are commonly associated with short-lived phishing infrastructure.

No TLS certificate is presented; HTTP connections are therefore unencrypted, a typical characteristic of fraudulent banking sites. The page title returned from the now‑inactive host reads "Alvra Credit Union – Secure Banking Solutions," suggesting an attempt to masquerade as a financial institution, while the intelligence feed tags the campaign as impersonating the brand "Near." Trust‑rating services assign extremely low credibility: Gridinsoft scores the domain 0/100 and Scamadviser 1/100. VirusTotal analysis shows that 10 of 95 scanned security vendors flagged the domain, and it appears on one external blocklist.

The domain has been added to the PhishDestroy blocklist and is identified as a banking‑phishing campaign. Given the combination of a recent registration, low trust scores, lack of encryption, and multiple vendor detections, defenders should proactively block the domain at perimeter and endpoint layers, add its IP address and associated nameservers to deny lists, and monitor for any re‑registration or reuse of the same hosting provider. Continuous traffic analysis for DNS queries to the geebytescloud nameservers and for HTTP requests to the 198.23.193.170 address is recommended, as well as integration of the indicator set into threat‑intel feeds to catch potential copycat operations.