capitaluniontrustbank[.]com

Analysis of capitaluniontrustbank.com indicates that the site was registered through Name SRS AB on 13 July 2025. The domain resolves to the IPv4 address 172.245.14.131, which belongs to the HostPapa hosting provider (AS36352) and is geolocated in the United States. No TLS certificate was observed, implying that the site was served over plain HTTP at the time of takedown. The page title retrieved before the domain was taken offline reads “CapitalUnionTrust – Mobile Banking | Credit Cards | Mortages | Auto Loan | Financial Firm”, reinforcing the claim of a banking‑related service. VirusTotal records show that two of ninety‑five scanning engines flagged the domain, suggesting limited but notable malicious detection.

The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy filtering service. AlienVault OTX references the domain in one threat‑intel pulse, further corroborating its association with malicious activity. Reputation services assign extremely low trust scores: Scamadviser rates it 1 / 100 and Gridinsoft rates it 0 / 100. The site is classified as a banking phishing campaign that impersonates an unspecified “across” brand target. Current status is offline, confirming that the hosting has been removed or the site is otherwise unavailable.

Uncertainty remains regarding the full scope of the phishing kit, the exact victim population, and whether additional infrastructure such as secondary IPs or command‑and‑control servers was employed, as no further technical artefacts have been published. Defenders should continue to monitor the IP address 172.245.14.131 for any reactivation, enforce blocklists that include this domain, and consider adding the associated host provider to network‑level deny lists. Incident response teams receiving emails or messages referencing “CapitalUnionTrust” should treat them as malicious and advise users to avoid providing credentials.