providencetrust[.]live

Providencetrust.live was observed hosting a page titled "Providence Trust Bank". The domain resolves to the IPv4 address 162.254.39.3, which is allocated to Namecheap, Inc. (AS22612) in the United States. Its authoritative name servers are dns1.namecheaphosting.com and dns2.namecheaphosting.com. No TLS certificate was presented, indicating the site operated over plain HTTP at the time of capture.

The domain was registered on 21 February 2026. VirusTotal analysis shows that 11 of 93 scanning engines flagged the host, reflecting a moderate level of malicious confidence. The site has been added to at least one public blocklist and is currently blocked by the PhishDestroy sinkhole, resulting in an offline status. Evidence confirms that the site was employed to impersonate a financial institution, as suggested by the page title.

However, the specific content of the landing page, credential‑capture mechanisms, or any associated malicious payloads have not been publicly released, leaving those aspects uncertain. Defenders should update URL filtering rules to deny any traffic to providencetrust.live, enforce TLS inspection to catch attempts to serve the domain over HTTP, and monitor DNS queries for the associated name servers. Network sensors should flag connections to 162.254.39.3 and correlate with the 11 VirusTotal detections. Adding the domain to internal blocklists and sharing the indicator with peer organizations will reduce exposure.