app[.]freedomfinancial-fx[.]com

Analysis of the domain app.freedomfinancial-fx.com indicates a phishing campaign targeting users through brand impersonation, specifically mimicking a financial institution as suggested by the page title 'Home - Topview Savings and Banking.' The domain was registered on June 13, 2025, through NameSilo, LLC, and resolves to the IP address 198.12.93.82, hosted on AS36352 (HostPapa) in the United States. Infrastructure analysis reveals the use of nameservers ns1.megatronserver.com and ns2.megatronserver.com, a hosting pattern consistent with other phishing operations observed in recent months. Detection data from security vendors is limited but indicative of malicious activity. As of the latest scan, two of ninety-five security vendors on VirusTotal flagged the domain as suspicious. Additionally, the domain appears on one security blocklist, and PhishDestroy has actively blocked access to it.

The absence of an SSL certificate further reduces the domain's legitimacy, as modern financial services typically enforce HTTPS encryption. The domain's Gridinsoft trust score of 0/100 corroborates these findings, reflecting a high-risk assessment based on observable infrastructure and detection metrics. The domain was taken offline prior to this report, though its prior activity suggests a focus on social media phishing, a tactic often employed to distribute fraudulent links through platforms with high user engagement. While the exact content of the phishing page remains unanalyzed, the page title and scam classification imply an attempt to deceive users into believing they are interacting with a legitimate banking service.

Defenders should treat this domain as part of a broader campaign, particularly given its association with known phishing nameservers and hosting providers frequently abused for such purposes. Organizations are advised to monitor for residual indicators, including the IP address 198.12.93.