paybnkk[.]com

Analysis of paybnkk.com, created on 11 March 2026 and currently taken offline, shows multiple indicators of a high‑risk generic banking phishing operation. Google Safe Browsing classifies the domain as social engineering, and the site is listed on PhishDestroy and one additional security blocklist. The authoritative name servers ns1.hostcreed.com and ns2.hostcreed.com resolve the domain to IP 192.142.54.88, which is hosted in the Netherlands under ASN 214036 (Ultahost, Inc.). The MX record points to the domain itself, a pattern often used to receive victim communications.

The site presents a page title “Home | Mobile Banking, Credit Cards, Mortgages, Auto Loan”, suggesting an attempt to impersonate a financial institution. Technical fingerprints reveal a PHP application served by LiteSpeed, with client‑side libraries including Typekit, Modernizr, jQuery and support for HTTP/3. The TLS certificate is issued by Let’s Encrypt (R12), providing encryption but no validation of the domain’s legitimacy. VirusTotal scans returned ten detections out of ninety‑five engines, reinforcing the malicious assessment.

The registrar listed as TuringSign Inc. d/b/a Cosmotown is commonly associated with disposable or low‑cost registrations. While the offline status limits immediate traffic observation, the combination of safe‑browser flag, blocklist inclusion, hosting details, and the financial‑oriented page title provides sufficient evidence for classification as a phishing site targeting banking credentials. Defenders should block the domain at perimeter firewalls and DNS filtering, monitor for any outbound connections to the identified IP, and add the domain to internal threat intelligence feeds. Ongoing verification of the hosting provider and any future re‑activation should be performed, and any emails originating from the domain’s MX record should be quarantined pending further analysis.