signaturetbk[.]com

The domain signaturetbk.com was observed hosting a credential‑phishing page titled “Signature Trust | Checking, Savings, Credit Cards & More”. The site was taken offline before the report date of 25 July 2026, and its current status is listed as offline. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The domain is registered through Cloudflare, Inc. and uses the authoritative nameservers daisy.ns.cloudflare.com and dylan.ns.cloudflare.com. TLS termination is provided by a Google Trust Services certificate labeled “WE1”, indicating a valid HTTPS configuration despite the malicious intent.

Reputation services flag the domain heavily. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal reports that 12 of 93 scanning engines have flagged the domain as malicious, reinforcing the phishing classification. The site leverages Cloudflare’s edge network and supports HTTP/3, which may aid in evading basic network‑level filters. PhishDestroy has also blocked the domain, confirming its inclusion in known phishing mitigation feeds.

The evidence confirms that signaturetbk.com was used for credential harvesting targeting financial‑service customers, as indicated by the page title and the “Credential Phishing” scam type. No further content analysis is available because the site is offline, leaving the exact phishing payload and lure mechanisms unverified. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration attempts, and consider adding the associated IP address to threat‑intel feeds. Ongoing observation of Cloudflare‑hosted assets and the listed nameservers is recommended to detect potential reuse of the same infrastructure for future campaigns.