firstnatibn[.]online

The domain firstnatibn.online was observed to host a generic phishing page that mimics the First National Bank brand, as indicated by the page title “Home - The First National Bank”. Registration data show the domain was created on 06 August 2025 and was registered through Global Domain Group LLC. The authoritative name servers are dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com and dns4.lytehosting., which resolve the domain to the IPv4 address 163.61.188.5. The IP belongs to AS153568, identified as NEW DHAKA HARDWARE, and is geolocated in the United States. No TLS certificate was presented for the host, indicating the site operated over plain HTTP only.

The domain has been taken offline, and current status flags it as “offline”. Reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain appears on one security blocklist. PhishDestroy has explicitly blocked the host, and five of ninety‑five VirusTotal scanners flagged the domain as malicious. The combination of a high‑confidence brand impersonation, low trust score, blocklist presence, and multiple vendor detections supports an elevated risk rating.

Defenders should ensure the domain is added to local and network‑level blocklists, monitor traffic to the associated IP address for residual activity, and consider extending detection rules to cover the lytehosting.com name server range. Ongoing observation of any re‑registration attempts or similar infrastructure reuse is recommended, as threat actors often recycle name servers and hosting assets. Until further forensic evidence is obtained, the domain should be treated as malicious and excluded from any allow‑list policies.