fairmontplc[.]com

Analysis of the domain fairmontplc.com shows it was registered on November 18, 2022 through Atak Domain Bilgi Teknolojileri A.S. and is currently taken offline. The site resolved to the IP address 192.3.141.252, which is hosted in the United States under AS36352 operated by HostPapa. No TLS certificate was observed, indicating that the site was delivered over plain HTTP.

The page title returned by the server was "Bank – Fairmont PLC," providing no direct reference to the claimed target brand, although threat intelligence identifies the campaign as a Facebook brand impersonation. The domain has been listed on a single security blocklist and is actively blocked by the PhishDestroy mitigation service. VirusTotal scans recorded a single positive detection out of ninety‑five submitted scanners, confirming that at least one security vendor flagged the domain as malicious. The Gridinsoft trust score of zero out of one hundred further reinforces the low reputation of the hosting infrastructure.

Observed evidence is limited to the registration record, IP resolution, blocklist presence, and the solitary VirusTotal flag; no additional artifacts such as SSL details, multiple nameserver entries, or extensive vendor detections were available. Defenders should continue to block traffic to 192.3.141.252 and add fairmontplc.com to local deny lists, monitor for any re‑appearance of the domain or related subdomains, and consider sharing the indicator with threat‑sharing communities to improve collective detection. Ongoing surveillance of the registrar Atak Domain Bilgi Teknolojileri A.S. may be warranted to detect future registrations that could be used for similar brand‑impersonation campaigns.