wingks[.]pro

This domain, wingks.pro, operates as a fraudulent credential harvesting portal targeting users of financial institutions. Analysis indicates the site mimics legitimate banking or payment service login pages, employing social engineering tactics to trick victims into submitting sensitive credentials such as usernames, passwords, and multi-factor authentication codes. The infrastructure is designed to closely resemble authentic platforms, often using cloned branding elements and URL structures that appear plausible at first glance. Evidence supporting this assessment includes technical indicators such as a VirusTotal detection score of 3/95 security vendors, indicating confirmed malicious classification by multiple engines. The domain was registered on July 02, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It currently resolves to the IP address 104.21.76.141 and is listed on one security blocklist. The SSL certificate is issued by Google Trust Services, which, while legitimate, is commonly exploited by threat actors to lend false credibility to phishing sites. Users who have visited wingks.pro or entered credentials on this domain should immediately revoke any submitted login information from associated accounts. Passwords for any financial, email, or other sensitive services accessed from the same device should be changed using a separate, trusted machine. Multi-factor authentication tokens previously used on the site must be reset. Network administrators are advised to block the domain and its resolving IP at the perimeter. Monitoring for unauthorized transactions or account modifications is critical, as compromised credentials may be used for follow-on attacks such as fraudulent transfers or identity theft.