probin-energy[.]com

This domain, probin-energy.com, is actively engaged in credential theft operations targeting professionals in the energy and commodity trading sectors. The site mimics legitimate corporate login portals to harvest usernames, passwords, and potentially multi-factor authentication codes. Visitors are presented with a polished interface labeled 'Welcome - Probin-energy and Commodity Trading,' designed to appear as an authentic business platform, increasing the likelihood of successful credential capture. Analysis indicates the domain was registered on January 27, 2026, through TuringSign Inc. d/b/a Cosmotown, a registrar frequently associated with high-risk domains. The site is flagged by 7 out of 95 security vendors on VirusTotal, and appears in 2 threat intelligence pulses on AlienVault OTX. Additionally, it is blocked by one security blocklist, further confirming its malicious nature. The infrastructure employs common web technologies such as Bootstrap, jQuery, and LiteSpeed, alongside an SSL certificate issued by Let's Encrypt, which is often exploited to lend false legitimacy to phishing sites. If you or someone in your organization has visited probin-energy.com or entered any credentials on the site, immediate action is required. First, reset all passwords associated with the account, prioritizing email and single-sign-on credentials. Enable multi-factor authentication if not already active, and monitor accounts for unauthorized access or transactions. Report the incident to your organization’s security team or IT administrator, and consider submitting the domain to additional threat intelligence platforms to aid in broader detection efforts. Avoid interacting with the site or any links originating from it to prevent further exposure.