apexunion[.]trustspheres[.]pro

The domain apexunion.trustspheres.pro was identified on July 23, 2026 as hosting a page whose title reads "Apex Bank - Dedicated to innovating, simplifying, and humanizing digital banking." Technical fingerprinting shows the site was powered by PHP and a collection of front‑end libraries including Bootstrap, GSAP, OWL Carousel, jQuery, and the JivoChat widget, and it was delivered through a LiteSpeed web server supporting HTTP/3. The site resolved to the IPv4 address 163.61.188.222, which belongs to AS153568 operated by NEW DHAKA HARDWARE and is geolocated to the United States. The TLS certificate was issued by Let’s Encrypt under the R13 series, confirming the use of a free, automated certificate authority.

Email routing is directed to mx.plingest.com with a priority of 10, and authoritative name resolution is provided by dns101.registrar-servers.com and dns102.registrar-servers.com, both associated with NameCheap, Inc. The domain has been listed on a single security blocklist and was actively blocked by the PhishDestroy service. VirusTotal analysis recorded a single positive detection out of ninety‑five scanners, indicating at least one security vendor flagged the domain as malicious. The site’s operational status is currently offline, limiting direct observation of its content, but the combination of a financial‑oriented page title, the presence of a live chat widget, and the detection history supports a classification as a generic phishing infrastructure targeting banking credentials.

Uncertainties remain regarding the exact user‑facing payload, such as form fields or credential capture mechanisms, because the site is no longer reachable. Defenders should add apexunion.trustspheres.pro and its resolving IP address 163.61.188.222 to blocklists, monitor the associated name servers for re‑registration, and enforce email filtering for the mx.plingest.com destination.