zenithtrustbank[.]co

This domain is flagged as a high‑risk banking phishing site. The domain zenithtrustbank.co was registered on 2026-03-28 through Dynadot Inc and resolves to 198.251.84.200, an IPv4 address owned by AS53667 FranTech Solutions in the United States. The site serves a credential‑phishing page indicated by the page title “Zenith Trust Bank” and an HTTP 302 redirect. The TLS certificate is issued by Let’s Encrypt (R13), and the server reports LiteSpeed with HTTP/3 support. Automated analysis detects Bootstrap, jQuery, Slick, OWL Carousel, Smartsupp and other front‑end libraries, consistent with a typical phishing landing page. On VirusTotal, six of ninety‑one scanners flagged the domain, and it appears on one external blocklist. Gridinsoft assigned a trust score of 0/100, and PhishDestroy has already blocked the host. Nameservers ns5.asurahosting.com, ns6.asurahosting.com, ns5.my-control-panel.com and ns6.my-control-panel.com are in use. The evidence confirms active credential‑phishing infrastructure, but details of the credential collection mechanism, phishing email distribution, or victim targeting are not yet disclosed. Defenders should block the domain and its IP at network perimeter, add the host to DNS sinkhole lists, monitor for outbound connections to 198.251.84.200, and update email security policies to reject messages purporting to originate from Zenith Trust Bank. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this infrastructure.