corrsteadunion[.]com

This domain, corrsteadunion.com, operates as a brand impersonation phishing portal targeting users of financial services. Analysis of the page content reveals a fraudulent banking interface using the title 'Corrstead Union - Dedicated to innovating, simplifying, and humanizing digital banking,' designed to deceive visitors into entering sensitive account credentials. The site employs social engineering tactics typical of credential harvesting campaigns, including professional branding and urgent account verification prompts to lower user vigilance. Evidence supporting the malicious classification includes detection by 10 out of 95 security vendors on VirusTotal, presence on one security blocklist, and registration through Ultahost, Inc. on December 25, 2025. The domain resolves to the IP address 159.100.6.5, located in Germany under the same hosting provider. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate (R12), which, while providing encryption, does not validate the legitimacy of the site. The creation date, recent and during a holiday period, aligns with patterns observed in short-lived phishing operations. Users who visited corrsteadunion.com should immediately revoke any entered credentials, particularly banking or financial login details. All potentially exposed passwords should be changed from a secure device, and multi-factor authentication should be enabled where available. Monitor financial accounts for unauthorized transactions and report any suspicious activity to the relevant financial institution. If personal or payment information was submitted, consider placing a fraud alert on credit reports. The domain has been taken offline, but users should remain cautious of similar phishing attempts using comparable naming conventions or branding.