The domain fnval.top was registered on March 26, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently hosted on the IP address 188.114.97.3. Its authoritative nameservers are dave.ns.cloudflare.com and sandra.ns.cloudflare.com, indicating that the domain is using Cloudflare’s DNS infrastructure. VirusTotal analysis shows that 13 of 91 security vendors flag the domain as malicious, providing a moderate confidence signal that the site is being used for nefarious purposes.
Independent phishing intelligence feeds have added fnval.top to two blocklists; it is listed by PhishDestroy and OpenPhish, both of which categorize the domain as a generic phishing host. The domain appears on public blocklists, suggesting that many security products already block traffic to it. No public page title, brand target, or phishing kit information is presently available, so the exact payload or credential‑stealing method cannot be confirmed at this time.
The overall risk assessment remains high because the domain is actively resolving, is freshly created, and is already being flagged by multiple detection engines. Defenders should add fnval.top to deny‑list controls at DNS, firewall, and proxy layers, and monitor for any outbound connections to the associated IP address 188.114.97.3. Continuous re‑evaluation is recommended as additional telemetry, such as sandbox analysis or URL preview, becomes available.