bankidcz[.]com

This domain, bankidcz.com, poses a high-risk phishing threat designed to steal banking credentials from users under the guise of a legitimate Czech financial authentication service. Analysis indicates the site mimics official BankID login portals, tricking victims into entering sensitive account details, including usernames, passwords, and two-factor authentication codes. Once captured, these credentials are typically used for unauthorized account access, fraudulent transactions, or sold on underground markets. The campaign specifically targets Czech-speaking users, leveraging localized language and branding to enhance credibility. Technical indicators confirm the malicious nature of this infrastructure. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to the IP address 194.15.112.203, hosted in the Czech Republic under International Hosting Solutions, a provider with a history of hosting phishing sites. As of the latest scan, 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, with Google Safe Browsing explicitly classifying it as phishing. Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy, further validating its fraudulent purpose. The SSL certificate, issued by Let's Encrypt (serial number E7), provides a false sense of security while failing to mitigate the underlying threat. Users who visited bankidcz.com or entered credentials on the site should take immediate action to mitigate risk. First, change passwords for all financial accounts, prioritizing those associated with Czech banking institutions. Enable multi-factor authentication if not already active, using app-based or hardware tokens instead of SMS-based methods. Monitor bank statements for unauthorized transactions and report any suspicious activity to the respective financial institution. If personal or financial data was submitted, consider placing a fraud alert or credit freeze with relevant credit bureaus. Finally, scan local devices for malware using updated security tools, as phishing sites often deploy additional payloads to maintain persistence or exfiltrate further data.