smnbank[.]org

Analysis of www.smnbank.org as of July 27 2026 indicates that the domain is actively used in a banking phishing campaign. The domain was registered on 10 January 2024 through the registrar Sav.com, LLC and is served by the nameservers ns10.controlpanelnet.com and ns9.controlpanelnet.com. DNS resolution points to the IPv4 address 13.140.180.106, which is the sole host observed for this domain. The infrastructure has been identified by the PhishDestroy blocklist and currently appears on one public security blocklist, confirming that at least one external mitigation service has taken action against it.

A VirusTotal analysis involving 91 antivirus and URL‑reputation engines returned no detections; however, the lack of a positive flag does not constitute evidence of benign behavior, especially given the confirmed phishing intent. The domain’s age of over two years suggests a deliberate setup rather than a short‑lived test. No additional public intelligence such as Safe Browsing alerts, Open Threat Exchange reports, SSL certificate details, or HTTP response codes are available, leaving the exact content and delivery mechanisms unverified.

Defenders should prioritize blocking DNS resolution to 13.140.180.106 and the domain name itself at the network perimeter, enforce outbound filtering of traffic to the associated nameservers, and monitor for any credential‑stealing activity targeting the brand implied by the domain. Continuous re‑scanning with multi‑engine services is advised, as detection signatures may emerge as the campaign evolves. Incident response teams should also consider user‑education campaigns highlighting the risk of unsolicited communications that reference the “SMN Bank” brand and encourage verification through official channels.