app[.]standardtrustfund[.]com

Analysis of app.standardtrustfund.com shows a newly registered domain (creation date February 21, 2026) that is actively serving content. The registration was performed through ChocolateChipDomains, LLC, and the domain resolves to 198.12.80.250, an address owned by AS36352 HostPapa in the United States. The site returns HTTP 200 responses and presents a page titled “Application Form”, which is typical of credential‑harvesting pages.

Infrastructure indicators reinforce the malicious profile. The domain uses the nameservers ns1.afternic.com, ns2.afternic.com, and a partial verification‑d3jclucsp89ganyqbydeny.ns entry, suggesting reliance on third‑party DNS services. The SSL certificate is identified as R12, and the site has been flagged by eight of ninety‑five VirusTotal scanners. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one external security blocklist. PhishDestroy has already added the domain to its block list.

While the observed indicators are consistent with a phishing operation, certain details remain unclear. The incomplete nameserver string may hide additional DNS configurations, and the specific payload or credential collection mechanism behind the “Application Form” page has not been publicly disclosed. No malware hashes or payload URLs have been observed, leaving the exact tactics and target selection open to further investigation.

Defenders should treat app.standardtrustfund.com as high‑risk. Immediate actions include adding the domain and its resolving IP 198.12.80.250 to deny‑list rules, monitoring DNS queries for the associated nameservers, and enforcing email filtering to block messages that reference the “Application Form”. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this infrastructure.