banhill[.]com

The domain banhill.com remains active as of July 18, 2026 and is classified as a generic phishing site with a high risk rating. Intelligence sources indicate that the domain appears in six separate AlienVault OTX threat pulses, suggesting repeated observations across different platforms. Administrative data show the domain was registered through GoDaddy.com, LLC on September 20, 2011 and continues to use Cloudflare nameservers (coen.ns.cloudflare.com and savanna.ns.cloudflare.com). DNS resolution points to the IPv4 address 188.114.97.3, which is currently reachable and serves content under a TLS certificate issued by Google Trust Services (certificate label WE1). VirusTotal analysis reports that five out of ninety‑one security vendors have flagged the domain, providing further corroboration of malicious intent. While the specific phishing payload or targeted brand has not been disclosed, the convergence of multiple threat intelligence indicators, a valid SSL certificate often used to lend legitimacy, and a modest but non‑trivial detection rate across scanners justify a precautionary stance. Defensive teams should consider adding banhill.com and its resolving IP 188.114.97.3 to block lists, monitoring outbound traffic for any attempted connections, and updating intrusion detection signatures to capture related patterns. Continuous re‑evaluation is advised, as future activity could expand the observed threat surface.