citizenspringtrust[.]com

The domain citizenspringtrust.com was registered on February 21, 2026 through Cosmotown, Inc. and currently resolves to the IP address 86.48.22.239, which belongs to AS40021 Contabo Inc. in the United States. HTTP requests return a 200 status code and the site presents a TLS certificate issued by Let’s Encrypt (R13), indicating that encrypted communications are available. The page title retrieved from the host is “Citizen Spring Trust- Your New Favorite Bank,” matching the declared scam type of banking phishing. Infrastructure analysis shows the site is served by the orangehost.com name servers (ns1.orangehost.com, ns2.orangehost.com) and utilizes client‑side libraries including Typekit, Smartsupp, Modernizr, jQuery, and HTTP/3 support.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy, confirming that threat‑intelligence feeds have identified it as malicious. VirusTotal scans report that three of ninety‑five security vendors flag the domain, providing additional corroboration of its malicious nature. No other public reputation services or safe‑browsing lists are referenced in the available data. While the technical footprint is well documented, the content of the landing page has not been examined, leaving uncertainty about the exact phishing workflow, credential collection mechanisms, and any additional payloads that may be delivered.

Defenders should treat the domain as high‑risk and enforce blocking at network perimeter, DNS, and endpoint layers. Continuous monitoring of the associated IP range and the orangehost.com name servers is advised, as the hosting provider may be leveraged for further fraudulent sites. Incident response teams should also consider sharing indicators of compromise, such as the domain name, IP address, and SSL fingerprint, with threat‑sharing communities to improve collective detection.