emv[.]flrtrustline[.]net

PhishDestroy has flagged the domain emv.flrtrustline.net as an active credential theft campaign targeting unsuspecting users. This domain, registered through NAMECHEAP INC on March 31, 2025, resolves to IP 64.20.54.43 and operates under a ZeroSSL certificate, attempting to appear legitimate. The page is designed to harvest login credentials under the guise of FLTrustLine, a financial service platform, suggesting users may be tricked into surrendering sensitive account details. Analysis of technical indicators reveals this threat remains undetected by security vendors, with VirusTotal currently showing 0 detections out of 95 scans. The domain’s recent creation date and lack of established reputation make it particularly dangerous, as users may not recognize it as malicious. Additionally, the use of a legitimate-looking SSL certificate (ZeroSSL) further enhances the phishing page’s credibility, increasing the likelihood of successful credential theft. Users who have interacted with emv.flrtrustline.net should immediately change passwords for any accounts entered on the site and enable multi-factor authentication where available. Monitor accounts closely for unauthorized transactions or login attempts. If credentials were reused across other services, update those accounts as well. Report the domain to your organization’s security team or to PhishDestroy to help block future attacks. Avoid visiting the domain entirely to prevent further exposure.