file.fvtt-nrrr.com is an impersonation phishing page whose title reads "Tiny File Manager", the name of a widely used open-source web file manager. PhishDestroy first saw it on 2026-09-10. On 2026-10-19 the domain still resolved, but the page content could not be loaded. The page title shows a file manager login, while we classified the site as impersonation phishing.
How the scam works
Impersonation pages copy the look of a trusted service so visitors type in credentials without hesitation. Here the familiar "Tiny File Manager" branding signals a login screen. Anyone who enters a username and password there hands them to the operator. Those credentials can then be replayed against real file managers, hosting panels, or any other account that shares the same password.
Evidence
VirusTotal flagged the domain with 15 of 89 engines on 2026-09-18. The vendors raising alerts include BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft, CyRadar and Chong Lua Dao. That spread across unrelated security vendors carries weight. Even so, most engines stayed silent, so many users' tools would not warn them. Among the blocklists we track, PhishDestroy is currently the only one that lists it.
Infrastructure
The domain was registered on 2022-08-14 through Cloudflare, Inc., roughly four years before it came to our attention. A domain that old may have been repurposed rather than created for this page. The serving IP sits on the Korea Telecom network in South Korea. Its free Let's Encrypt certificate gives the page a padlock icon, which says nothing about whether the site is legitimate.
What to do
If you entered a username or password on this page, change it right away. Change it everywhere else you used it too, starting with hosting accounts, file managers and email. Turn on two-factor authentication where it is available, and check recent logins and file changes on any server you manage for unfamiliar activity. Defenders should block the domain and its IP at DNS and proxy level. They should also search logs for earlier connections and treat any user who reached it as a possible credential compromise.
発行者 Let's Encrypt / YE1· stored validity ends in 49 days
Network & certificates
Stored technical evidence
Network & DNS
Resolved IP
175.197.54.10
Network ASN
AS4766
Organization
Korea Telecom
Observed location
Gwanak-gu, KR
Server header
nginx
ネームサーバー 2
alec.ns.cloudflare.com
jen.ns.cloudflare.com
Location describes the IP network.
TLS証明書
Issuer
Let's Encrypt / YE1
Valid from
2026-09-09 20:54:06
Valid until
2026-12-08 20:54:05
Hostname coverage
Certificate hostname mismatch
Validity
Within stored validity dates
Collection time
2026-09-10 22:02:08 UTC
Collection source
PhishDestroy collector
Certificate fingerprint3c87dfe226e6206b7f6471f147ed7dc2b6411be478e7f46be4a40ceb939908a5Certificate names · 2 SANs
fvtt-nrrr.com
game.fvtt-nrrr.com
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
