coretrustcreditunion[.]com

Analysis indicates that the domain coretrustcreditunion.com was registered on 5 May 2025 through the Atak Domain registrar and currently resolves to the IP address 104.21.63.72, which belongs to Cloudflare’s AS13335 network in the United States. The domain is hosted behind Cloudflare’s DNS service, as shown by the authoritative nameservers mckinley.ns.cloudflare.com and yichun.ns.cloudflare.com. No TLS certificate is presented, meaning the site does not serve HTTPS traffic. The site title captured during a brief crawl reads “Core Trust Credit Union - Dedicated to innovating, simplifying, and humanizing digital banking,” matching the legitimate brand’s marketing language and confirming a brand‑impersonation intent.

Security‑rating services assign extremely low trust scores: Gridinsoft reports 0/100, and Scamadviser reports 1/100. VirusTotal scans show that nine of ninety‑five antivirus or URL‑reputation engines flagged the domain, and the domain appears on at least one public blocklist. PhishDestroy has taken the domain offline, and its current status is listed as offline. The available evidence points to a classic brand‑impersonation campaign targeting users of Core Trust Credit Union, although the “brand target” field lists “across,” suggesting the operators may intend to reuse the same infrastructure for multiple financial brands.

The lack of a TLS certificate, combined with the low trust scores and multiple vendor detections, indicates a high likelihood of malicious intent. Defenders should block the domain at perimeter filters, add the IP address 104.21.63.72 to deny lists if not already covered by existing Cloudflare block rules, and monitor future registrations from Atak Domain that resolve to the same Cloudflare IP range. Continuous re‑scanning of the domain on VirusTotal and inclusion in internal phishing‑email detection signatures are recommended until the infrastructure is fully mitigated.