firstmidwestsbank[.]com

firstmidwestsbank.com was registered on March 22 2026 through Ultahost, Inc. and resolves to the IPv4 address 159.100.6.19, which is geolocated to Germany and listed as part of the UltaHost hosting network. The domain’s DNS configuration includes four authoritative name servers (ns1‑ns4.ultahost.com) and an MX record pointing to the same domain with priority 0, suggesting the operator intended to receive mail directly on the compromised site. A Let's Encrypt R12 certificate is present, providing TLS encryption but offering no assurance of legitimacy. The web server identifies itself as LiteSpeed and delivers assets built with Tailwind CSS, Alpine.js, and jsDelivr, while supporting HTTP/3.

The page title returned during the brief online presence reads “Home – Seft Bank,” a misspelling that aligns with the declared scam type of banking phishing and indicates an attempt to mimic a legitimate financial institution. Reputation signals are strongly negative. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist. PhishDestroy has already taken the site offline, and the current status is listed as “taken offline.” VirusTotal analysis shows that 16 of 94 scanned security vendors flagged the domain, reinforcing the malicious assessment.

The combination of a newly created domain, low‑trust score, multiple detections, and the presence on a dedicated phishing blocklist signals an elevated risk for credential harvesting targeting bank customers. Uncertainty remains regarding the exact phishing workflow because the site is no longer reachable and no detailed page content has been captured. Defenders should block the domain and its associated IP at perimeter firewalls, update email filtering rules to reject messages from the domain’s MX host, and monitor for any related indicators such as the listed name servers or the TLS certificate fingerprint.