willisinvestmentcapital[.]sbs

PhishDestroy identifies willisinvestmentcapital.sbs as an active fake investment scam landing page currently categorized under generic phishing campaigns. The domain specifically mimics legitimate investment firms to deceive visitors into depositing funds or revealing financial credentials. Given the elevated risk designation and confirmed malicious activity, security teams should treat this as a high-priority threat due to its active hosting and deceptive branding.

This domain was flagged by VirusTotal with 4 out of 95 security vendors detecting malicious content. It was registered through Dynadot LLC on February 02, 2026, and resolves to IP address 37.49.229.75. The SSL certificate is issued by Let's Encrypt, which, while legitimate, does not validate the site’s legitimacy. Despite its recent registration, initial sandbox detections indicate attempts to harvest login credentials and inject skimming scripts targeting payment forms.

To mitigate exposure to this fake investment phishing site, users should avoid visiting willisinvestmentcapital.sbs and organizations should block the domain at DNS and firewall levels. Security tools should inspect outbound HTTPS traffic to IP 37.49.229.75 to prevent data exfiltration. It is recommended to blacklist the domain in email filters and endpoint protection platforms using the seed identifier 27d10e for automated correlation across security systems.