Phishing alert: DKB bank login page planted on compromised Benin district website arrondhevie.bj

What happened

The phishing-alert account @TheThreatWire posted on X on 12 November 2026 (Phishing Alert #139) that hxxps://arrondhevie.bj/5-RFun_TTVYBfv/login.php is a phishing page impersonating Deutsche Kreditbank AG (DKB), the German bank. The domain also appears on the Phishing Army extended blocklist, a public phishing domain blocklist. arrondhevie.bj is the official website of the Arrondissement de Hêvié, a local district of Abomey-Calavi in Benin, so the phishing page appears to have been planted on a compromised legitimate site; the district is not the operator, and only the /5-RFun_TTVYBfv/login.php path is reported here. DKB is impersonated and is not the operator. Log in to online banking only through the official DKB app or by typing the bank's address yourself. Source: https://x.com/TheThreatWire/status/2120795390333399194

How the scam works

These pages copy a familiar login, payment or delivery form so that a typed password, one-time code, card number or other personal detail goes to the operator rather than to the real company. The address is often a look-alike domain, a newly registered shop, or a free host such as Weebly, Wix, Firebase, Vercel, Workers or Pages. Some kits cloak the real form from scanners and only show it in certain countries or to certain devices. The brand whose name or logo appears is being impersonated and is not involved, unless the report says the page was planted on a compromised official site, in which case only that path is the phishing lure. Open the official app or type the company's real address yourself. If you already entered a password or a card number, change the password on the official site, turn on a new two-factor method, and contact the company and your bank.

Source

Source: https://x.com/TheThreatWire/status/2120795390333399194