rewardss[.]homes

This domain, rewardss.homes, poses a direct financial credential theft risk by impersonating the official Bank of the Philippine Islands (BPI) login portal. Visitors are presented with a fraudulent interface designed to harvest banking usernames, passwords, and potentially one-time passcodes (OTPs). The site mimics legitimate banking authentication flows, increasing the likelihood of victim compliance. Given the domain's focus on a major financial institution, the threat extends beyond individual account compromise to potential large-scale fraud, including unauthorized fund transfers and identity theft. Analysis indicates the domain was registered on May 31, 2026, through Hefei Juming Network Technology Co., Ltd, a registrar frequently associated with malicious infrastructure. At the time of assessment, 6 out of 95 security vendors on VirusTotal flagged rewardss.homes as malicious, a detection rate consistent with active phishing campaigns. The domain resolves to the IP address 104.21.54.49, a Cloudflare proxy commonly used to obscure hosting origins. Additional technical indicators include the presence of Adobe Experience Manager and Salesforce Interaction Studio, technologies rarely deployed on legitimate banking portals but often exploited in phishing kits to enhance realism. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds. If you visited rewardss.homes or entered any credentials, immediately cease all interaction with the site. Change your BPI online banking password using a separate, trusted device and enable multi-factor authentication if not already active. Monitor your bank statements for unauthorized transactions and report any suspicious activity to BPI’s official fraud response team. Do not respond to any follow-up communications claiming to be from the bank, as these may be secondary phishing attempts. Consider placing a temporary fraud alert on your credit file to mitigate potential identity theft. Users who entered sensitive information should assume their credentials are compromised and take proactive steps to secure all linked accounts.