info-signere-digitilsynet[.]com

This domain was identified as part of a credential theft campaign targeting users of BankID, Norway’s electronic identity verification system. The site impersonates legitimate BankID authentication portals to harvest login credentials, potentially enabling unauthorized access to financial accounts, government services, and personal data. Analysis indicates the infrastructure was designed to exploit trust in the BankID brand, a high-value target for threat actors seeking to compromise Norwegian digital identities. Infrastructure analysis reveals the domain was registered on March 10, 2026, through OwnRegistrar, Inc., and resolved to the IP address 193.24.123.124, hosted on AS200593 (PROSPERO OOO) in Russia. The domain’s SSL certificate, issued by Let’s Encrypt (R12), was flagged by 23 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. Google Safe Browsing classified the domain as phishing, and the page title explicitly references BankID, reinforcing its fraudulent intent. The domain has since been taken offline, though residual risk may persist for users who interacted with it prior to its removal. Users who visited info-signere-digitilsynet.com are advised to take immediate action to mitigate potential compromise. Those who entered credentials should assume their BankID login details were exposed and initiate a password reset through the official BankID portal. Additionally, affected individuals should monitor their financial accounts and government service profiles for unauthorized activity. Enabling multi-factor authentication (MFA) on all critical accounts is strongly recommended. If the site was accessed via a corporate or institutional device, internal security teams should be notified to assess potential lateral movement risks. Given the domain’s association with Russian-hosted infrastructure, users should also review their systems for signs of follow-up malware or phishing attempts.