ftrac-inform[.]org

This domain, ftrac-inform.org, is flagged as a credential theft operation impersonating FINTRAC, Canada’s financial intelligence unit. The site displays the page title 'FINTRAC - Центр цифрового возврата средств,' suggesting a fraudulent refund or recovery scheme targeting Russian-speaking users. No crypto drainer kit signatures were identified, but the presence of credential harvesting elements aligns with typical brand impersonation tactics used to extract login credentials or personal financial data. Infrastructure analysis reveals the domain was registered on May 25, 2026, through NAMECHEAP INC, an uncommon future-dated registration likely intended to evade immediate detection. It resolves to the IP address 188.114.96.3, which is associated with Cloudflare’s network, a common obfuscation tactic. As of the latest scan, VirusTotal reports 0/95 security vendor detections, indicating low initial visibility. The domain appears on one security blocklist, suggesting limited but confirmed malicious classification. Technologies detected include jQuery, Facebook Pixel, and Cloudflare Browser Insights, which may be leveraged for tracking user interactions or delivering malicious payloads. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. The future-dated registration and use of Cloudflare suggest an attempt to prolong operational lifespan while minimizing detection. Users who interacted with the site should assume credential exposure and initiate password resets for any accounts accessed during the period of activity. Organizations should monitor for similar domains using the same registrar or IP range, particularly those impersonating financial or government entities.