solbank-finances[.]pages[.]dev

PhishDestroy identifies solbank-finances.pages.dev as an active banking phishing domain designed to mimic legitimate financial institutions. This domain employs deceptive tactics to harvest sensitive banking credentials and financial data from unsuspecting users. The infrastructure suggests the use of a drainer kit, likely tailored to extract login details, transaction data, or personal identification information under the guise of a secure banking portal. No affiliation with established financial brands has been confirmed, indicating a probable spoofing campaign. This domain shows a VirusTotal detection score of 0/95, remaining unflagged despite its malicious nature. It resolves to IP 172.66.47.62 and is registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services. The domain has been flagged on 2 security blocklists and is blocked by ScamSniffer and Enkrypt, highlighting its suspicious classification. The technical indicators suggest a rapidly evolving threat with evasion techniques, including the use of legitimate infrastructure (Cloudflare, Google Trust Services) to obscure malicious intent. As of current analysis, solbank-finances.pages.dev remains active and under investigation, posing a moderate to high risk to potential victims. Immediate response actions include continued monitoring, domain takedown requests, and user advisories. While detection rates remain low, users are strongly advised to avoid interacting with this domain. Remaining risk includes potential expansion into broader phishing campaigns or integration with additional malicious infrastructure. Enhanced scrutiny and proactive blocking mechanisms are recommended to mitigate further harm.