promarketbanking[.]sbs

PhishDestroy identifies promarketbanking.sbs as an active banking phishing domain designed to steal online banking credentials by masquerading as a legitimate financial institution. The site lures victims with a convincing fake login portal, capturing usernames, passwords, and potentially one-time codes, which are then sent directly to threat actors for unauthorized account access and fraudulent transactions. This is not a passive scam—it is a live credential-harvesting operation actively resolving to 198.251.84.200 and hosted on infrastructure associated with web skimming campaigns. This domain was flagged with alarming specificity: only 2 out of 95 VirusTotal security vendors currently detect it, revealing a dangerous gap in automated detection. Registered through Dynadot LLC on May 13, 2026—just days ago—the domain is dangerously new and likely part of a fast-moving campaign. Its SSL certificate issued by Let’s Encrypt offers a false sense of security, as phishing sites commonly use free certificates to appear legitimate. Despite its youth, the site is already being used in active phishing attempts, with low detection rates making it especially perilous for unsuspecting users. If you visited promarketbanking.sbs and entered any banking credentials or personal information, immediately change your passwords on all financial accounts and enable two-factor authentication where available. Contact your bank directly using official channels to report possible compromise and monitor your accounts for unauthorized transactions. Avoid clicking any links from emails or messages related to this domain, and consider using browser-based protection tools or DNS filtering services to block access to known malicious domains. Stay vigilant: newly registered domains with low detection rates are prime tools for credential theft and financial fraud.