firsttrust[.]onlineisecure[.]com

The domain firsttrust.onlineisecure.com was observed hosting a credential phishing page targeting banking customers, as indicated by the page title "First Trust | Secure Online Banking & Financial Solutions" and the classified scam type of Banking Phishing. The domain resolves to the IPv4 address 104.255.173.7, which is allocated to Tier.Net Technologies LLC in the United States under AS397423. No SSL certificate was presented during the scan, leaving the site vulnerable to man‑in‑the‑middle observation of any transmitted data. Registration details show the domain was created on February 21, 2026 through OwnRegistrar, Inc., and the authoritative name servers listed are ns15.qservers.net and ns16.qservers.net, with an additional null entry.

VirusTotal analysis recorded nine detections out of ninety‑three scanned security vendors, confirming that multiple AV engines recognize the host as malicious. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. Current operational status is offline, suggesting the phishing campaign has been taken down or the hosting provider removed the content.

Defenders should continue to block both the domain and its resolved IP address at perimeter firewalls and DNS filtering layers, and add the observed name servers to any existing threat‑intel feed that monitors suspicious resolver activity. Ongoing monitoring of the AS397423 prefix is advised, as the same infrastructure may be reused for future campaigns. Incident response teams should also verify that any internal credentials potentially exposed to this site are rotated, and users should be reminded to verify the authenticity of banking communications before submitting credentials.