procss-membres1asw1ebichekis[.]sbs

The domain procss-membres1asw1ebichekis.sbs is currently active and identified as a high-risk phishing site specializing in payment verification fraud. Analysis indicates the infrastructure is designed to mimic legitimate payment processing portals, as evidenced by the page title 'Verificación de Pago,' suggesting a focus on Spanish-speaking targets or financial institutions operating in Spanish-language regions. No specific brand impersonation has been confirmed, but the thematic content aligns with credential harvesting and financial fraud tactics commonly employed in phishing campaigns. Infrastructure analysis reveals the domain was registered on July 02, 2026, through Spaceship, Inc., and resolves to the IP address 15.197.162.184. Detection metrics indicate the domain has been flagged by 17 of 95 security vendors on VirusTotal, reflecting moderate but concerning consensus regarding its malicious nature. Technologies detected include Node.js and Express for backend operations, with Cloudflare employed for content delivery and potential obfuscation of origin servers. The presence of HTTP Strict Transport Security (HSTS) headers suggests an attempt to appear legitimate while maintaining encrypted connections, a tactic often used to evade basic security checks. Current status confirms the domain remains operational, posing an ongoing threat to users who may encounter it through phishing emails, malicious advertisements, or compromised redirects. Organizations and individuals are advised to block the domain and associated IP address at the network perimeter. Endpoint protection systems should be updated to include this domain in blocklists, and users should be educated to recognize payment verification scams, particularly those using non-standard or recently registered domains. Monitoring for related infrastructure, such as similarly named domains or shared IP addresses, is recommended to identify potential campaign expansion.