Phishing page olx.nowe-04-11-26.eu.cc targets PKO Bank Polski iPKO banking logins
TheThreatWire flagged olx.nowe-04-11-26.eu.cc as a phishing page targeting PKO Bank Polski iPKO banking logins, using the path /pay/personal/iPKO/. The domain is also on the Phishing Army blocklist.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 4 November 2026 TheThreatWire, an account that posts automated phishing alerts on X, flagged olx.nowe-04-11-26.eu.cc as a phishing page targeting customers of PKO Bank Polski, Poland's largest bank, in its Alert #113. The alert listed the URL path /pay/personal/iPKO/ followed by a random token, and described the page as aimed at iPKO, the bank's online banking service. A screenshot attached to the post shows an iPKO-style log in page. The Phishing Army community blocklist, checked by scammers.com on 4 November 2026, also lists the domain.
How the scam works
The domain combines a well-known brand name with the word for new and the date 04-11-26, a throwaway name on a free .eu.cc subdomain. The path imitates iPKO, and the page copies the bank's login screen to capture the customer number and password. Polish banking phishing of this kind commonly asks next for the one-time code sent by SMS or generated in the mobile app, which lets the criminals authorise a login or a transfer at the moment the victim enters it.
With an iPKO login and a confirmation code, criminals can sign in, add a trusted payee, or approve a transfer out of the account. The page was promoted under an OLX-related name, exploiting the familiarity of the classifieds brand, but the credentials it targets are banking logins rather than marketplace accounts. PKO Bank Polski tells customers that it never asks for logins or codes through links, and to reach iPKO only by typing the address or using the official app. Anyone who entered details should contact the bank at once to block access, change the password, and watch for unauthorised transfers. The domain and path come from the alert and the blocklist, and have not been independently checked by scammers.com.
Source
Post by @TheThreatWire on X, 4 November 2026 (5:37 AM ET), with a screenshot of the page. Not independently verified by scammers.com.
Red flags
- A banking login page on a throwaway .eu.cc subdomain with a date in the name.
- A path imitating iPKO such as /pay/personal/iPKO/.
- A request for the SMS or app one-time code right after the login.
- A page promoted under an unrelated brand name.
- Any prompt to approve a transfer or add a payee.
If you were targeted
- 1Do not enter your iPKO customer number, password or one-time code on a page reached from a link.
- 2Reach iPKO only by typing the bank's address or using its official app.
- 3If you entered details, call PKO Bank Polski immediately to block access and change your password.
- 4Watch for new trusted payees or transfers you did not set up.
- 5Report the link to the bank and to CERT Polska.