account[.]regaltrustfb[.]com

This domain, account.regaltrustfb.com, is actively engaged in brand impersonation targeting Across, a financial services platform. Analysis indicates the site is designed to deceive users into believing they are interacting with a legitimate banking institution, as evidenced by the page title 'RegalTrust Financial Bank -'. The primary threat posed by this domain is credential theft, where victims may unknowingly submit sensitive authentication details, including usernames, passwords, and multi-factor authentication codes, directly to threat actors. Given the high-risk nature of this activity, immediate mitigation is recommended for any systems or users that have interacted with this domain. Infrastructure analysis reveals multiple indicators of malicious intent. The domain was registered on March 14, 2025, through Cosmotown, Inc., and is currently hosted on IP address 163.61.188.222, associated with AS153568 (NEW DHAKA HARDWARE). Security vendors on VirusTotal have flagged this domain, with 3 out of 95 engines detecting it as malicious. Additionally, the domain appears on one security blocklist, further corroborating its classification as a threat. The SSL certificate, issued by Let's Encrypt (R13), does not mitigate the risk, as it is commonly used by both legitimate and malicious sites to encrypt traffic. Users who have visited account.regaltrustfb.com or entered credentials on this site should take immediate action. All exposed credentials must be considered compromised and should be reset across all platforms where they were reused. Multi-factor authentication (MFA) tokens associated with these accounts should also be revoked and reissued. Network administrators are advised to block the domain and its resolving IP (163.61.188.222) at the perimeter to prevent further access. Endpoint detection systems should be updated to include this domain in their threat intelligence feeds. If financial transactions were initiated, affected users should contact their financial institution to report potential fraud and monitor accounts for unauthorized activity.