fcsr[.]online[.]don-melcrencorp[.]site

This domain, fcsr.online.don-melcrencorp.site, is assessed as an elevated-risk phishing infrastructure impersonating an online banking platform. Analysis indicates the domain was registered on March 21, 2025, through Global Domain Group LLC and currently resolves to IP 163.61.188.222, hosted on AS153568 (NEW DHAKA HARDWARE) in the United States. The page title explicitly states 'fcsr - Online Banking Platform,' aligning with the scam type classification of banking phishing. Detection data from July 2026 shows six security vendors flagging the domain on VirusTotal, and it appears on at least one security blocklist, specifically PhishDestroy.

Trust scores from Gridinsoft and Scamadviser are 0/100 and 1/100, respectively, further supporting its malicious classification. Infrastructure analysis reveals the use of nameservers dns1.lytehosting.com through dns4.lytehosting.com, a pattern observed in other phishing campaigns leveraging LiteSpeed web server technology. Detected frontend components include Bootstrap, jQuery UI, jQuery CDN, FancyBox, Popper, and Smartsupp, which are common in both legitimate and fraudulent sites but often exploited for credential harvesting. The SSL certificate is issued by Let's Encrypt (R12), a frequently abused certificate authority in phishing operations due to its free and automated issuance process.

As of July 23, 2026, the domain has been taken offline, though defenders should treat associated indicators—IP, nameservers, registrar, and hosting provider—as potentially compromised. While the exact content of the phishing page remains unanalyzed, the combination of banking-themed page title, low trust scores, vendor detections, and blocklist presence provides sufficient evidence to classify this as a banking phishing threat.