hammanadata[.]com[.]ng

This domain, hammanadata.com.ng, is flagged as a high-risk phishing site targeting users of online payment and mobile airtime services. Registered on April 13, 2026, through AfeesHost Ltd, the domain remains active as of July 12, 2026, and resolves to IP 148.72.153.160, hosted on infrastructure provided by velia.net in the United States. Nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com indicate use of Namecheap hosting services. The site presents itself under the page title 'Hammanadata - Buy internet data bundles, VTU Airtime, Pay Electricity Bills, TV Subscription,' suggesting an intent to mimic legitimate platforms offering mobile top-ups, utility bill payments, and subscription services. Analysis indicates the domain is currently operational, returning an HTTP 200 status, and employs a Let's Encrypt SSL certificate (R13) to appear secure. Technologies detected include Unpkg, SweetAlert, and HTTP/3, which may be used to enhance user interaction and evade detection. The domain appears on one security blocklist (PhishDestroy) and is assigned a trust score of 0/100 by Gridinsoft, reflecting confirmed malicious activity. While one of 94 security vendors on VirusTotal flags the domain, this does not provide conclusive evidence of broader detection, but it aligns with the observed blocklist presence. Defenders should treat this domain as active phishing infrastructure and prioritize blocking at DNS, IP, and network levels. The combination of payment-related services in the page title and the use of low-reputation hosting suggests a focus on financial fraud. Further investigation into associated accounts, transaction flows, and linked infrastructure is recommended to determine the full scope of the campaign. No evidence currently links this domain to a specific threat actor or broader phishing kit, so attribution remains uncertain.