pnc-secureauth-com[.]at

PhishDestroy identified the domain pnc-secureauth-com.at as a credential phishing threat, actively impersonating PNC Bank to steal user login credentials. This domain employs a fake authentication interface designed to deceive victims into entering sensitive financial information. No specific drainer kit was detected, but the phishing page closely replicates PNC's secure authorization portal.

Technical indicators reveal a high-risk profile: VirusTotal flagged the domain with 11 out of 95 security vendors marking it as malicious. The domain was created on February 21, 2026, and its registrant details are obscured. The page title, www.pnc-secureauth-com.at, matches the deceptive login page. Additionally, the domain appears on one security blocklist and is not listed on Google Safe Browsing, though this status may change as threat intelligence updates. The domain's IP address was not publicly available at the time of analysis, but the registration date indicates a very recent creation, typical of phishing campaigns.

Currently, the domain has been taken offline, mitigating immediate risk to users. However, similar domains may still be active. PhishDestroy advises users who may have visited this site to change their PNC Bank passwords immediately and enable multi-factor authentication. The remaining risk includes potential copycat domains and the possibility that compromised credentials are already being exploited. Users should always verify URLs through official channels and report any suspicious sites to PhishDestroy for analysis.