hoxtonbank[.]com

The domain www.hoxtonbank.com was observed on 2026-07-12 and is classified as a high‑risk banking phishing site. The site presents a page titled “Savings and Property – we’ll help you achieve your goals,” mimicking a legitimate financial institution to lure victims into disclosing credentials. Threat intelligence assigns a risk level of high and marks the status as active.

The domain was registered on 2026-02-20 through Unstoppable Domains Inc. It uses the authoritative name servers ns5.nl.hostsailor.com and ns6.nl.hostsailor.com. DNS resolution points to the IPv4 address 194.36.191.196, which belongs to Host Sailor Ltd operating under AS60117 and is geolocated in the Netherlands.

The site serves an SSL certificate issued by Let’s Encrypt (R12), indicating the presence of HTTPS encryption but not authenticity. HTTP requests receive a 302 redirect response, a common technique to hide the final landing page. On VirusTotal the domain received a single positive detection out of 95 scanners, and it appears on one external blocklist. The Gridinsoft trust score is 0 out of 100, and PhishDestroy has already blocked the domain.

While the exact phishing payload has not been disclosed, the combination of a brand‑spoofing page title, active status, low trust score, and the presence on a phishing‑specific blocklist justifies immediate mitigation. Defenders should add 194.36.191.196 to outbound and inbound blocklists, enforce DNS sink‑hole rules for www.hoxtonbank.com, and monitor the associated name servers for future changes. Continuous re‑scanning with multiple AV engines is advised to capture any emerging detections. Organizations should also educate users about unsolicited requests for banking credentials that reference “Savings and Property” or similar phrasing.