http-bankomat[.]cc

The domain http-bankomat.cc is currently classified as a high‑risk banking phishing platform. Intelligence indicates the site remains active as of the report date, July 26, 2026, and is reachable over HTTP with a 200 response code, suggesting a live front‑end. The domain is registered through Gransy, s.r.o., and authoritative name resolution is provided by ns3.owlhost.net and ns4.owlhost.net. It appears on a single security blocklist, and PhishDestroy has already blocked the domain, confirming its malicious intent.

VirusTotal analysis shows that 16 of 91 security vendors have flagged the domain, reinforcing the suspicion of phishing activity. No additional context such as page title, SSL certificate details, or content snapshots is available, leaving the exact payload and credential‑stealing mechanisms uncharacterized. The limited blocklist presence and modest vendor detection count suggest the campaign may be in an early deployment phase or operating under a low‑visibility hosting arrangement.

Defenders should continue to block the domain at network perimeters, update URL filtering policies, and monitor DNS queries for the associated nameservers. Incident response teams should treat any traffic to http-bankomat.cc as hostile, isolate affected endpoints, and investigate potential credential exposure. Ongoing surveillance is advised to detect any expansion of the infrastructure, such as additional nameservers, IP changes, or increased detection rates across threat intelligence platforms.