natwstbkuk[.]com

PhishDestroy first observed natwstbkuk.com on Sep 8, 2026. Stored content metadata identifies Natwest as the apparent target. The captured page title is “NatWest Bank – NatWest Bank”. Current evidence score: 88/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, Cloudflare Radar, URLQuery, and URLScan. VirusTotal recorded 10 detections among 89 engines: alphaMountain.ai, CRDF, ESET, Emsisoft, Fortinet, Gridinsoft, Netcraft, SOCRadar, Sophos, Webroot on Sep 8, 2026 at 18:24 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLQuery recorded 1 threat-system alert on Sep 8, 2026 at 10:12 UTC. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Natwest and assigned phishing as its category on Sep 8, 2026 at 11:08 UTC. Non-positive and contextual checks: AlienVault OTX listed 4 community pulse references (not vendor detections) on Sep 8, 2026 at 18:25 UTC. The separate external-blocklist snapshot contained no matches on Sep 8, 2026 at 14:20 UTC. Google Safe Browsing returned no flag on Sep 8, 2026 at 18:24 UTC.

The collector marked the hostname reachable on Sep 8, 2026 at 10:09 UTC, but did not retain the HTTP response code. Registration records for the domain list AppCroNix Infotech Private Limited, d/b/a VEBONIX.com as the registrar and Sep 3, 2026 as the creation date. Registration preceded first observation by 4 days. At collection time, the hostname resolved to 198.251.84.200 on AS53667 (FranTech Solutions). The recorded endpoint location is Luxembourg, LU. The stored server header is LiteSpeed. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. TLS metadata lists YR2 as the certificate issuer.

The content indicators and 4 positive source findings support the current Natwest impersonation and phishing classification. The target field identifies Natwest, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.