fntm[.]org

This domain, fntm.org, is an active phishing site designed as a fake login portal impersonating financial service providers. Analysis indicates the site is currently operational and engineered to harvest user credentials under the guise of legitimate banking or payment platforms. No specific brand name has been confirmed, but the structure and content align with credential theft campaigns targeting the financial sector. Infrastructure analysis reveals the domain was registered on June 18, 2025, through arin, a regional internet registry, and resolves to the IPv6 address 2a06:98c1:3121::3. Security vendor assessments show 4 of 95 VirusTotal engines flag the domain as malicious, while it appears on one security blocklist. The trust score from Gridinsoft is 0/100, indicating high risk. Detected technologies include Node.js, Envoy proxy, Express framework, HSTS enforcement, and Akamai CDN infrastructure, suggesting an attempt to mimic enterprise-grade security and performance. The site remains active, displaying a 'Just a moment...' page title, which is consistent with intermediary loading screens used to filter traffic or evade automated detection. Organizations and end users are advised to block the domain and its associated IP at the network level. Security teams should monitor for credential submissions or redirects to fntm.org in proxy and DNS logs. Users who may have interacted with the site should reset passwords immediately and enable multi-factor authentication on all financial accounts. Additional scrutiny is recommended for any communications directing users to this domain, particularly those claiming to be from banking or payment institutions.