flnanzonlinegvbmf.net hosted a fake Volksbank sign-in page aimed at the bank's online banking customers. The domain name looks like a misspelled government finance portal, with an "l" in place of the "i" in "finanz", but the page itself presented Volksbank branding. PhishDestroy first detected it on 2026-09-17. The site has been offline since 2026-09-18 and was still unreachable when last checked on 2026-10-19.
How the scam works
Victims typically arrive through a link in an email or text message that warns of an account problem or a pending tax matter. The link opens a page titled simply "Login" that copies Volksbank's look. Anything typed into the form, such as usernames, PINs and sometimes one-time codes, goes straight to the operators. With those credentials they can sign into the real account, add payees or approve transfers before the victim notices.
Evidence
Seven of 89 VirusTotal engines flagged the domain on 2026-09-17: alphaMountain.ai, CRDF, Emsisoft, Fortinet, Netcraft, SOCRadar and Webroot. The count is modest, but it includes Netcraft and Fortinet, both of which track phishing closely. urlscan.io returned a malicious verdict and detected Volksbank branding on the page, which directly confirms the impersonation. Spamhaus lists the domain in its DBL under the phishing category, and it is on the PhishDestroy blocklist.
Infrastructure
The domain was registered through TUCOWS.COM, CO. on 2026-09-11, six days before PhishDestroy caught it. It went dark one day after detection. That short arc of registering, phishing briefly and disappearing is typical of disposable bank-phishing domains. The site was hosted on 217.60.103.97 in Switzerland.
What to do
If you entered your Volksbank login details on this page, contact your bank right away so it can block online access and review recent transactions. Change your banking PIN or password through the official app or website, and check your statements for transfers or new payees you did not set up. If you entered a one-time code or confirmed a push approval, tell the bank that too, because it may have authorised a payment. Be alert to follow-up calls from people posing as bank staff. Defenders should block the domain and the hosting IP, and search mail and proxy logs for visits since 2026-09-11 to identify users who may need a credential reset.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(KN)
