fastcreditunionbank[.]live

fastcreditunionbank.live is currently active and classified as a high‑risk banking phishing campaign. The site returns an HTTP 302 redirect and presents the page title “Maintenance Mode”. Infrastructure analysis shows the domain resolves to 163.61.188.7, an IP located in the United States associated with MIT. Registration was performed through OwnRegistrar, Inc., and the domain uses the name servers dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, and dns4.lytehosting.com. The TLS certificate is issued by Let’s Encrypt (YR1). VirusTotal records indicate that 14 of 91 scanning engines have flagged the domain. The domain appears on one known security blocklist and has been reported by PhishDestroy. AlienVault OTX references include two threat‑intel pulses linking the domain to phishing activity. While the page content beyond the title has not been publicly disclosed, the observed indicators suggest a purposeful attempt to lure victims. Defenders should add the domain and its associated IP to block lists, monitor DNS queries for the listed name servers, and consider sinkholing the IP address. Ongoing observation is advised to detect any payload changes or additional infrastructure.