fnbocreditus[.]credit

Analysis conducted on July 23, 2026 identifies fnbocreditus.credit as a credential‑phishing infrastructure targeting FNBO credit‑card customers. The domain was registered on March 07, 2026 through NiceNIC International Group Co., Limited and resolves to the IPv4 address 5.252.116.244, which is assigned to AS207569 I‑SERVERS LTD located in Russia. The site employed a Let's Encrypt R12 certificate, indicating HTTPS was active at the time of capture. HTTP traffic was served by Nginx behind Cloudflare, and client‑side libraries such as Chart.js, Tailwind CSS, Unpkg, jsDelivr, Tippy.js and jQuery CDN were detected, suggesting a typical modern web stack used to render the page titled “FNBO | Credit Card Login”.

The domain appears on a single security blocklist and is currently listed by PhishDestroy as taken offline. VirusTotal scans recorded 15 detections out of 94 participating engines, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 / 100, and the authoritative nameservers are a.dnspod.com and c.dnspod.com. The evidence confirms that the operator set up a short‑lived credential‑phishing site shortly after registration and then removed it, a pattern consistent with opportunistic campaigns.

Defenders should add the domain and its resolving IP to network‑level deny lists, monitor DNS queries for the associated dnspod.com nameservers, and enforce strict credential‑validation controls for FNBO‑related services. Continuous observation of the AS207569 prefix for newly registered domains using similar technology stacks is advisable, as the infrastructure may be reused in future campaigns. Organizations should also ensure that endpoint protection solutions are updated to reflect the 15 VirusTotal detections associated with this host.