firstonlineroyalbanks[.]xyz

PhishDestroy identifies firstonlineroyalbanks.xyz as a live banking impersonation site designed to harvest online banking credentials under the guise of a trusted financial brand. Visitors are presented with realistic login pages that closely mirror legitimate portals, tricking users into surrendering usernames, passwords, and multi-factor authentication codes directly to threat actors. Security researchers have confirmed active hosting on 163.61.188.5 and routine certificate renewals through Let’s Encrypt, indicating ongoing operation despite recent takedown warnings. This domain was flagged on VirusTotal by three of ninety-five participating engines and was only registered on April 29, 2026 via Cosmotown Inc, a registrar frequently leveraged in fast-turnover fraud campaigns. The brief window since creation and the limited vendor detection underscore both the novelty and the stealth of this operation, making traditional signature-based defenses less effective in the early stages. SSL issuance and hosting stability further suggest the adversaries are actively maintaining operational security, rotating infrastructure to prolong viability. If you have already visited the site, refrain from entering any credentials or financial information—even if prompted to “verify” your account. Disconnect from the network immediately, clear browser cookies related to the impersonated bank, and scan your device with updated anti-malware tools. Report the incident to your bank using official channels, enable stronger account protections such as hardware keys, and consider a password reset across other services if the same credentials were reused. Forward any screenshots or URLs to your security team for deeper forensic review and domain takedown escalation.