bny-exchange[.]com

This domain, bny-exchange.com, is an active credential theft site targeting users through brand impersonation of BNY Mellon. Analysis indicates the site is designed to harvest login credentials by mimicking the legitimate financial institution's interface, presenting a high-risk threat to corporate and individual users. Infrastructure analysis reveals the domain was registered on December 20, 2025, through NameSilo, LLC, and resolves to IP address 154.37.214.88, hosted in Hong Kong under AS979 (NetLab Global). The site lacks an SSL certificate, a red flag for secure financial transactions. Security vendors have flagged this domain, with 14 of 95 VirusTotal engines detecting malicious activity. It appears on two security blocklists and is actively blocked by multiple threat intelligence platforms. The page title, 'BNY,' further confirms the intent to deceive users by leveraging the BNY Mellon brand. As of the latest verification, bny-exchange.com remains active and continues to pose a significant risk. Organizations and users are advised to block the domain at the network level and implement email filtering rules to prevent delivery of messages containing this domain. Financial institutions should alert customers about this impersonation campaign and recommend multi-factor authentication (MFA) for all account access. Security teams are encouraged to monitor logs for connections to 154.37.214.88 and review recent authentication attempts for signs of compromise.