alvracreditunion[.]com[.]protrackcouriers[.]com

The domain alvracreditunion.com.protrackcouriers.com is a phishing site involved in brand impersonation, specifically targeting the brand 'near'. It poses an elevated threat level as it attempts to deceive users into believing it is associated with legitimate banking services. Currently, the site has been taken offline, mitigating its immediate risk to users. However, it was previously active and posed a risk as a scam site.

Technical indicators for alvracreditunion.com.protrackcouriers.com include detections by 2 out of 95 VirusTotal vendors, specifically Fortinet and Gridinsoft. The domain was registered through Dynadot LLC on May 25, 2025, and resolves to the IP address 192.3.141.254 located in the US under AS36352 HostPapa. It appears on one security blocklist, PhishDestroy, and uses an SSL certificate issued by Let's Encrypt / R13. The page title observed was 'Alvra Credit Union - Secure Banking Solutions', indicating an attempt to impersonate a legitimate banking service.

For those who may have interacted with alvracreditunion.com.protrackcouriers.com, it is crucial to change any credentials that may have been compromised and enable two-factor authentication on affected accounts. Users should monitor their financial statements for any fraudulent activities. To report this phishing domain, individuals can contact organizations like PhishDestroy or use reporting tools provided by their email and internet service providers. Taking these steps can help mitigate the potential impact of such phishing scams.