marketbuffalo[.]click

The domain marketbuffalo.click was identified as a generic phishing threat, specifically designed to impersonate M&T Bank's personal banking login page. Currently offline, this domain posed a high risk to users who may have been tricked into entering sensitive credentials. The site's title, "Personal Banking | M&T Bank," closely mimicked the legitimate bank's interface, making it a convincing lure for unsuspecting victims.

Technical analysis reveals that marketbuffalo.click was registered through DYNADOT LLC on May 27, 2026, and resolved to IP address 31.56.229.111. It was flagged by 26 out of 95 security vendors on VirusTotal, indicating broad recognition as malicious. Additionally, it appeared on one security blocklist and was found in three AlienVault OTX threat intelligence pulses. Google Safe Browsing also flagged the domain for phishing. The SSL certificate was issued by Let's Encrypt (R12), which is commonly abused by malicious actors due to its free and automated issuance.

Given the domain's high risk level and its impersonation of a major financial institution, users are strongly advised to avoid any interaction with marketbuffalo.click. PhishDestroy recommends that individuals who may have visited the site change their M&T Bank passwords immediately and enable multi-factor authentication. Always verify URLs directly by typing the bank's official web address into the browser, and report any suspicious domains to security authorities.