cnhconectada[.]sbs

PhishDestroy identifies cnhconectada.sbs as an active credential theft domain mimicking legitimate services to harvest login details and crypto wallet credentials. The domain leverages a deceptive visual design and social engineering tactics to trick victims into entering sensitive information, with no known affiliation to the legitimate brand it impersonates. Given the absence of a crypto drainer kit payload in current telemetry, analysts assess this as a low-complexity but high-impact operation focused on stealing authentication credentials for financial accounts. This domain was flagged with a clean 3/95 detection score on VirusTotal at the time of analysis. It resolves to IP 188.114.96.3 and was registered on April 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED using a Let’s Encrypt SSL certificate. It remains unlisted on Google Safe Browsing (GSB) and has not been observed on major threat intelligence blocklists. The domain’s recent registration and pristine detection posture suggest a newly deployed or rapidly evolving threat infrastructure, possibly in the early stages of campaign distribution. While the current risk level is marked as 'under_investigation', the active status and lack of blocking infrastructure pose an immediate threat to users encountering the domain. Organizations and individuals are advised to block both the domain and associated IP at the network perimeter and DNS level. Continuous monitoring for new subdomains or related infrastructure is recommended, as this campaign may escalate into broader phishing or credential harvesting operations. Users should verify URLs and avoid entering credentials on suspicious pages until further validation is completed.