homebankaz[.]net

PhishDestroy identifies homebankaz.net as an active banking phishing domain designed to harvest financial login credentials or deploy malicious drainers. The domain mimics regional banking platforms, likely targeting Azerbaijani or Turkish-speaking users given the 'az' country code. No specific drainer kit has been publicly linked to this domain, but its structure suggests a browser-in-the-middle (BITM) or fake login portal kit targeting Azeri banks or payment systems.

This domain was flagged by only 1 out of 95 VirusTotal security vendors and is registered through NameSilo, LLC. It resolves to IP address 37.49.229.75 and was created on April 27, 2026. The domain uses a valid Let's Encrypt SSL certificate to appear legitimate. It has not been added to Google Safe Browsing (GSB) blocklists as of this report.

homebankaz.net is currently active with an elevated risk status. Users are strongly advised to avoid visiting this domain and to inspect financial transactions for unauthorized access. Security teams should block the domain at the DNS and firewall levels and flag the associated IP (37.49.229.75) in threat intelligence feeds. While only one vendor currently detects the threat, its recent creation date and low detection rate suggest potential evasion tactics — remaining a viable risk vector until widespread mitigation occurs.