canacrestonline[.]com

This domain, canacrestonline.com, is flagged as a high-risk phishing site targeting users of Cana Crest Online Bank. Analysis of the page title, "Home - Cana Crest Online Bank | Your reliable banking partner," confirms brand impersonation designed to deceive victims into submitting login credentials. The threat type is classified as generic_phishing, with no evidence of a crypto drainer kit or advanced payload delivery at this stage. The campaign appears focused on credential harvesting, likely to facilitate unauthorized account access or financial fraud. Infrastructure analysis reveals the following technical indicators: the domain was registered on November 29, 2025, through TuringSign Inc. d/b/a Cosmotown, a registrar frequently associated with malicious domains. It resolves to the IP address 198.251.84.200, hosted on AS53667 (FranTech Solutions), an autonomous system with a history of hosting phishing infrastructure. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing (GSB) data is not currently available. The domain appears on one security blocklist, and the SSL certificate is issued by Let's Encrypt (YR1), a common choice for both legitimate and malicious sites due to its free and automated issuance process. As of the latest assessment, canacrestonline.com remains active, with no evidence of takedown or mitigation efforts. The domain's recent registration date and low detection rate suggest it may still be in the early stages of deployment, increasing the likelihood of evading detection by security tools. Users are advised to avoid interacting with the site and to verify banking portals through official channels only. Organizations should consider blocking the domain and IP at the network level, while monitoring for related infrastructure that may emerge as part of this campaign.