flhsmv[.]fdmvutm[.]vip

flhsmv.fdmvutm.vip is currently classified as a high‑risk generic phishing infrastructure. The domain was registered on 12 June 2026 through Gname.com Pte. Ltd. and resolves to the IPv4 address 43.130.11.224. Within a week of creation the domain appeared on a security blocklist and has been actively blocked by the PhishDestroy sinkhole. Google Safe Browsing has marked the site as a social‑engineering threat, and VirusTotal reports that 13 of 91 scanned security vendors flag the domain as malicious.

The detection spread across multiple AV engines suggests the presence of known phishing payloads or command‑and‑control artifacts, although the specific malware families have not been disclosed. The limited blocklist presence (one list) indicates that the infrastructure is still emerging, but the rapid adoption by protective services demonstrates a high likelihood of active credential‑harvesting campaigns. The IP address 43.130.11.224 is not presently associated with a known benign hosting provider, and no public ASN or geographic data were supplied, which hampers attribution efforts. Defenders should immediately deny any outbound connections to the domain and its resolved IP, incorporate the host into network‑level blacklists, and monitor DNS logs for repeated resolution attempts.

Continuous re‑query of VirusTotal and Google Safe Browsing is recommended to capture any changes in detection ratios. Because the domain is only days old, threat‑intel teams should also watch for derivative sub‑domains that may reuse the same registrar or hosting patterns. In the absence of a publicly available page title or SSL certificate details, further manual analysis of the live site is required to determine the exact phishing lure and any victim‑targeted brands. Until such data are obtained, the precautionary stance should remain high, with the domain treated as active and hostile.