crystallnationbgh[.]com

The domain crystallnationbgh.com has been identified as a brand impersonation threat, specifically targeting the Crystal National Bank of Ghana (CNB-GH). Analysis confirms the domain is currently offline, though prior activity indicates an intent to deceive users into divulging sensitive financial credentials. The threat type is classified as brand impersonation with a focus on credential theft, rather than generic phishing or crypto-related fraud. Infrastructure analysis reveals the domain was registered through Dynadot LLC on November 13, 2025, and previously resolved to the IP address 198.12.80.250, hosted on AS36352 (HostPapa) in the United States. The page title, "Crystal National Bank of Ghana (CNB-GH) - Banking and Finance," directly mimics the legitimate institution’s branding. Security vendors have flagged the domain, with 12 of 95 VirusTotal engines detecting malicious activity. It appears on one security blocklist and uses an SSL certificate issued by Google Trust Services (WE1), which may lend a false sense of legitimacy. The domain’s creation date and hosting provider align with patterns observed in other credential harvesting campaigns. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the infrastructure remains a residual risk until fully dismantled. Organizations and users are advised to block the domain at the network level, monitor for related domains registered through the same registrar, and verify SSL certificates when accessing financial services. Financial institutions should proactively warn customers about this impersonation attempt and reinforce multi-factor authentication (MFA) for account access. Security teams should treat any residual traffic to this domain as indicative of compromised credentials or ongoing fraud attempts.