fbghonline[.]com

Analysis indicates that fbghonline.com is an active phishing domain targeting financial or corporate users, registered on March 22, 2026. The domain resolves to 198.54.132.28, hosted on infrastructure associated with Tzulo in Canada, a provider previously linked to fraudulent activity. The site employs a Let's Encrypt SSL certificate (R12), which is commonly used by both legitimate and malicious sites to encrypt traffic. While the certificate itself does not confirm malicious intent, its presence alongside other indicators increases the risk of credential theft or data interception. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, and LiteSpeed technologies, a common stack for phishing kits due to its ease of deployment and customization. The page title, 'fbghonline – fbghonline.com,' suggests an attempt to appear as a branded or institutional portal, though no specific financial institution or brand is confirmed in the available data. The domain is currently flagged by one security blocklist and has been detected by 4 out of 94 security vendors on VirusTotal, reinforcing its classification as high-risk. The domain is registered through Ultahost, Inc., with nameservers ns1.ultahost.com through ns4.ultahost.com, a pattern consistent with bulletproof hosting providers that delay takedowns. Defenders should treat this domain as actively malicious, blocking resolution at the DNS level and monitoring for connections from internal networks. Given the lack of confirmed brand impersonation, organizations should assume this site is part of a broader phishing campaign until further analysis of its content is conducted. No evidence suggests the site has been taken down, and it remains accessible as of July 12, 2026.