firstinnovationbank[.]com

This domain, firstinnovationbank.com, is identified as a banking phishing site designed to impersonate financial institutions for credential harvesting. Analysis indicates the infrastructure is engineered to deceive users into submitting sensitive account details, including login credentials, personal identification numbers, and multi-factor authentication codes. The domain exhibits characteristics typical of credential phishing campaigns, including the use of a deceptive subdomain structure and cloned banking portal interfaces. No specific drainer kit signatures were observed in the available telemetry, though the presence of OpenResty suggests potential use of dynamic content delivery to evade detection. Infrastructure analysis reveals the domain was registered on June 21, 2025, through GMO Internet, Inc., a registrar frequently leveraged by threat actors for rapid domain deployment. It resolves to the IP address 198.12.66.123, which has been associated with prior phishing activity. Detection metrics indicate a VirusTotal score of 5/95, with security vendors flagging the domain as malicious. The domain appears on one security blocklist and is assigned a Gridinsoft trust score of 0/100, further corroborating its malicious classification. Technologies detected on the server include Nginx and OpenResty, which are commonly used to host phishing pages due to their flexibility and performance. As of the latest assessment, firstinnovationbank.com has been taken offline, likely in response to abuse reports or automated takedown mechanisms. However, the residual risk remains elevated due to the potential for the threat actors to redeploy the infrastructure under a new domain or IP address. Users who may have interacted with the site are advised to immediately reset their banking credentials, enable multi-factor authentication, and monitor their accounts for unauthorized transactions. Financial institutions are recommended to proactively alert customers about this campaign and implement domain monitoring to detect similar impersonation attempts.