ftrachub[.]com

This domain, ftrachub.com, poses as a fraudulent FINTRAC digital refund center, targeting individuals seeking financial reimbursements. Analysis of the page title, "FINTRAC - Центр цифрового возврата средств," indicates an attempt to impersonate the legitimate Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) to deceive users into submitting sensitive financial or personal information. The domain employs localization tactics, using Russian text to broaden its target demographic, suggesting a focus on non-English-speaking victims or those familiar with Cyrillic script. Such brand impersonation schemes often lead to credential harvesting, unauthorized transactions, or malware deployment once victims interact with the fraudulent interface. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain is flagged by 5 out of 95 security vendors on VirusTotal, a notably low but still significant detection rate that aligns with evasive phishing campaigns. Registered on May 09, 2026, through NAMECHEAP INC, the creation date is anomalous, as it predates the current date by several years, a common tactic to bypass new-domain filters. The domain resolves to the IP address 188.114.97.3 and is blocked by one security blocklist. Additional infrastructure includes Cloudflare services, which are frequently leveraged to obscure hosting origins and mitigate takedown efforts. Detected technologies such as jQuery, Facebook Pixel, and YouTube embeds further mimic legitimate websites, enhancing the deception. Users who visited ftrachub.com should assume their interactions were compromised. Immediately revoke any credentials entered on the site, particularly financial or government-related logins. Monitor linked accounts for unauthorized activity, including transactions, password changes, or unfamiliar device logins. Run a full antivirus scan to detect potential malware infections, as phishing sites often deploy secondary payloads. Report the incident to relevant authorities, such as the Canadian Anti-Fraud Centre (CAFC) or local cybercrime units, providing the domain, IP address (188.114.97.3), and any interaction timestamps. Enable multi-factor authentication on all critical accounts to mitigate further risks, and verify the legitimacy of any future communications claiming to be from FINTRAC through official channels only.