fnxmartincome[.]com

The domain fnxmartincome.com was registered on May 24, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently hosted on the shockhosting.com network, using nameservers ns1.shockhosting.com and ns2.shockhosting.com. DNS resolution points to the IPv4 address 208.123.116.152. The domain is listed on a single security blocklist and has been actively blocked by PhishDestroy, indicating that at least one defensive feed has identified it as malicious. VirusTotal analysis shows that two out of ninety‑five scanning engines have flagged the domain, providing independent confirmation of its suspicious nature.

No additional public intelligence such as a page title, SSL certificate details, HTTP response codes, or explicit brand impersonation has been disclosed, leaving the exact phishing lure and victim‑targeting vector undocumented. This lack of visible content means defenders cannot rely on content‑based signatures and must instead focus on infrastructural indicators. Defensive teams should add fnxmartincome.com to URL filtering, DNS sinkhole, and proxy block lists, and monitor traffic to the host IP 208.123.116.152 for any anomalous connections. Because the registrar and hosting provider are publicly known, threat‑intel analysts should watch for newly registered domains that share the same nameservers or IP block, as these may represent a broader campaign.

Continuous re‑scanning on multi‑engine platforms is advised to capture any escalation in detection counts. Organizations employing email security gateways should treat any communications referencing fnxmartincome.com as malicious and quarantine or reject them. In the absence of concrete page‑level evidence, the recommendation is to maintain a precautionary stance, enforce network‑level blocks, and update detection rules to include the observed infrastructure footprints.