Bank-themed domain points web and mail records to one IP
The domain maps to one IP address, names itself as its mail destination and authorizes that address to send email. Those settings establish configured web and mail roles, but vendor phishing classifications do not show that a page was served or messages were sent.
spectratrustbank.com points to 66.29.156.99, names itself as its mail destination, and explicitly includes that same IP address in its email sender policy. The relationship raises a more useful question than the bank-themed name alone: does the evidence establish a working phishing service, or infrastructure configured to support web and mail services? CTX Threat Intelligence’s records establish the configuration, not its use.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read