loweii[.]org

This domain, loweii.org, is identified as a phishing site designed to harvest BankID authentication credentials. BankID is a widely used electronic identification system, making it a high-value target for threat actors. Visitors to this site were likely presented with a fraudulent login interface mimicking legitimate BankID services, intended to deceive users into entering sensitive credentials such as usernames, passwords, or one-time codes. The stolen data could be used for unauthorized account access, financial fraud, or identity theft. Given the specificity of the target, this campaign poses a significant risk to individuals and organizations relying on BankID for secure authentication. Analysis indicates that loweii.org was registered on March 13, 2026, through Internet Domain Service BS Corp, a registrar frequently associated with malicious domain registrations. The domain resolves to the IP address 80.71.235.199, hosted under AS211673 (Mynymbox Hosting LLC) in the Netherlands, an autonomous system with a history of hosting phishing infrastructure. At the time of detection, 18 out of 95 security vendors on VirusTotal flagged this domain as malicious, confirming its classification as a generic phishing threat. Notably, the domain lacked an SSL certificate, which is unusual for legitimate financial services and further indicates its fraudulent nature. The domain was also listed on one security blocklist prior to being taken offline. If you visited loweii.org or entered any credentials on the site, immediate action is required to mitigate potential damage. First, revoke any active BankID sessions and contact your financial institution to report the incident and monitor for unauthorized transactions. Reset passwords and authentication tokens associated with BankID or any accounts linked to it. Enable multi-factor authentication (MFA) where available to add an additional layer of security. Scan your device for malware using updated security tools, as phishing sites may deploy additional payloads. Finally, report the incident to relevant cybersecurity authorities or your organization’s IT security team to assist in broader threat tracking and response efforts.