communitybanknh[.]com

This domain, communitybanknh.com, is actively impersonating a legitimate New Hampshire-based financial institution as part of a banking phishing campaign. Registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, the domain currently resolves to the IP address 194.58.106.196, which is geolocated in Russia and associated with Reg.Ru hosting infrastructure. The nameservers ns1.hosting.reg.ru and ns2.hosting.reg.ru further confirm this hosting provider's involvement, a pattern frequently observed in phishing operations targeting financial entities. Analysis indicates the domain is still operational, though it returns an HTTP 403 status, suggesting either restricted access or server-side blocking of automated scans. The SSL certificate is issued for communitybanknh.com, which may lend a superficial appearance of legitimacy to unsuspecting users. However, only one out of 95 security vendors on VirusTotal currently flags this domain, while Gridinsoft assigns it a trust score of 0/100. Additionally, the domain appears in one threat intelligence pulse on AlienVault OTX and is blocked by a single security blocklist, indicating limited but growing detection. The infrastructure reveals no direct ties to known phishing kits or compromised legitimate sites, though the use of a Russian hosting provider for a domain mimicking a U.S. bank is a notable red flag. Defenders should treat this domain as high-risk due to its active status, recent registration, and association with financial fraud. Immediate action includes blocking the domain and IP at network perimeters, monitoring for internal connections to 194.58.106.196, and alerting users to the impersonation attempt. Further investigation should focus on identifying related domains registered through the same provider or sharing similar naming conventions.