Researchers at My Online Security and the SANS Internet Storm Center have analyzed spam campaigns utilizing plausible imitations of legitimate banking domains to spread the Trickbot banking malware.
Source: Malware Spam Domains Imitating Popular Banks Spreading Trickbot Banking Trojan