trustedgesaving[.]live

Analysis of trustedgesaving.live, observed on July 24, 2026, indicates that the domain was registered on 21 February 2026 and is currently taken offline. The site presented the page title “Trustedgesaving- Your New Favorite Bank” and was classified as a brand impersonation campaign targeting American Express. The hosting resolves to IP 109.176.207.222, which belongs to the Dutch network AS214036 operated by Ultahost, Inc. The SSL certificate is identified as R10, suggesting a self‑signed or low‑trust certificate. VirusTotal recorded 10 detections out of 93 scanned scanners, reflecting a moderate level of malicious labeling.

The domain appears on a single security blocklist and has been blocked by the PhishDestroy service. Independent reputation services assign very low credibility: Scamadviser reports a trust score of 11 / 100 and Gridinsoft reports 0 / 100. These metrics collectively point to an elevated risk profile. The evidence confirms that the domain was used to impersonate American Express, though the exact phishing kit or page content beyond the title has not been publicly disclosed.

Uncertainty remains regarding the precise payload delivered to victims, the duration of active hosting before takedown, and whether additional infrastructure (such as command‑and‑control servers) was employed. Defenders should continue to block the domain at perimeter filters, enforce URL reputation checks, and monitor for similar newly registered domains that resolve to the same IP range or use comparable SSL characteristics. Ongoing observation of the AS214036 space and periodic re‑scanning of the domain, should it reappear, are recommended to capture any evolution of the campaign.