fhcu[.]online

fhcu.online was registered on 21 February 2026 and is presently taken offline. The domain resolves to the IPv4 address 198.12.66.123, which is allocated to AS36352 operated by HostPapa in the United States. Passive DNS and reverse‑lookup data confirm the sole association of the address with the suspect domain. The site presented a page title of “First Horizon Credit Union,” matching the brand target reported as a Base impersonation.

The SSL certificate is identified as rating R13, indicating a low‑trust certificate typically issued by free or shared hosting services. Reputation services have placed the domain on one security blocklist and PhishDestroy has explicitly blocked it. VirusTotal analysis returned three positive detections out of ninety‑three scanners, reinforcing the malicious classification. The threat vector is described as a crypto scam, suggesting the site may have attempted to solicit cryptocurrency payments under the guise of the credit‑union brand.

No additional public listings such as Google Safe Browsing, OTX, or other threat intel feeds were observed for this domain. The limited evidence base means that while the current indicators support a malicious rating, the full scope of the campaign – including any associated phishing pages, payloads, or victim outreach – remains unverified. Defenders should add 198.12.66.123 to network blocklists, enforce DNS filtering for fhcu.online, and monitor HostPapa‑hosted infrastructure for further suspicious registrations. Continuous re‑scanning of the domain and any related sub‑domains is advised, as the offline status may change if the operators reactivate the site.