cnhsaindo[.]sbs

PhishDestroy identifies cnhsaindo.sbs as an active generic phishing domain deployed in a broad credential harvesting campaign. This domain was flagged by 2 out of 95 security vendors on VirusTotal, indicating limited but notable detection coverage. It resolves to the IP address 188.114.97.3 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 10, 2026. Let’s Encrypt issued the SSL certificate, suggesting an attempt to appear legitimate. The domain has not been listed on Google Safe Browsing (GSB) at this time, and no brand impersonation or drainer kit has been confirmed in available telemetry. The domain remains active and continues to pose an elevated risk to end users who may encounter it via email, social media, or malvertising. Immediate defensive action includes blocking the domain and IP at network gateways and endpoints. While detection rates are currently low, the combination of recent registration, active infrastructure, and minimal blocking suggests a rising threat. Users should exercise heightened caution and verify any unsolicited links before interaction. Monitor for further IOC expansion as this campaign evolves.