cretatrust[.]pro

Analysis of the domain cretatrust.pro, created on 21 February 2026 and currently active, shows multiple indicators consistent with a phishing operation. The domain resolves to IP 217.21.90.191, which belongs to AS47583 Hostinger International Limited and is geolocated to India. The hosting provider is Hostinger, as reflected in both the registrar information (HOSTINGER operations, UAB) and the observed server technologies, including LiteSpeed, PHP, Bootstrap, Lightbox and HTTP/3. The site presents a valid TLS certificate issued by Let’s Encrypt (R12), and HTTP requests return a 200 status code, indicating that the page is reachable and serving content.

The page title returned by the server is “Creta Trust”, matching the domain name and providing no additional brand context. VirusTotal has recorded 2 detections out of 91 scanned security vendors, confirming that at least a minority of scanners flag the domain as malicious. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy service, reinforcing the suspicion of abusive use. Nameserver records point to ns1.dns-parking.com and ns2.dns-parking.com, typical of domains that have been recently registered and parked before deployment.

While the publicly available data do not disclose the exact phishing payload or targeted victim population, the combination of a recent registration date, active hosting on a shared provider, a legitimate‑looking TLS certificate, and the presence of the “Creta Trust” title suggests a generic credential‑harvesting site. Defenders should add cretatrust.pro to URL filtering and email gateway block lists, monitor DNS queries for the associated IP address, and enforce TLS inspection where possible to detect any credential submission. Continuous re‑scanning with VirusTotal and inclusion in threat intelligence feeds is recommended to capture any escalation in detection counts.