firsthavanabankplc[.]com

firsthavanabankplc.com was observed resolving to the IPv4 address 192.3.141.252, which is hosted in the United States under ASN 36352 (HostPapa). The domain was created on 3 June 2024 and registered through Atak Domain Bilgi Teknolojileri A.S. No TLS certificate was presented, indicating that the site operated without HTTPS protection. The sole page retrieved before the infrastructure was taken offline carried the title “FIRST HAVANA - Home”. Threat intelligence attributes the site to a credential‑phishing campaign that impersonates Google, as indicated by the “Impersonates: Google” label. Analysis by VirusTotal shows that six of ninety‑five scanning engines flagged the domain, and the domain appears on a single external blocklist, specifically PhishDestroy.

Independent reputation services assign extremely low trust scores, with Gridinsoft rating it 0 out of 100 and Scamadviser 1 out of 100. The domain’s current status is offline, and it has been removed from active hosting. Evidence confirms the use of a low‑reputation hosting provider and the absence of transport‑layer security, both common characteristics of malicious phishing infrastructure. However, the limited public visibility—only one page title and no additional samples—leaves the full scope of the phishing payload, landing pages, and any credential‑harvesting mechanisms uncertain. No additional indicators such as email templates, URL paths, or malware hashes have been released.

Defenders should add 192.3.141.252 to network‑level deny lists and monitor for DNS queries to firsthavanabankplc.com. Existing web‑filtering and email‑security solutions should ensure that any URLs matching this domain are blocked, even though the site is currently offline, to prevent future re‑use. Continuous monitoring of the registrar Atak Domain Bilgi Teknolojileri A.S. for new domains with similar registration patterns is advised, as threat actors often recycle the same registration service.