fnlocker[.]info

Analysis as of July 22, 2026 indicates that fnlocker.info is currently active and associated with generic phishing campaigns. The domain was registered on March 23, 2026 through Web Commerce Communications Limited dba WebNic.cc and points to the Cloudflare‑hosted address 172.67.211.219. DNS resolution uses the Cloudflare nameservers kira.ns.cloudflare.com and nitin.ns.cloudflare.com, suggesting the infrastructure is leveraging Cloudflare’s CDN and DDoS mitigation services. VirusTotal has recorded 14 of 95 scanned security vendors flagging the domain as malicious, reinforcing the suspicion of malicious intent.

The domain is listed on one external security blocklist and is actively blocked by the PhishDestroy sinkhole, confirming that at least one defensive platform has identified it as a threat. No additional telemetry such as Google Safe Browsing, OTX, or public sandbox analysis has been published for this host, leaving the broader ecosystem visibility limited. Given the available evidence, defenders should treat fnlocker.info as high‑risk. Network perimeter controls should deny outbound connections to the IP 172.67.211.219 when the FQDN matches fnlocker.info, and endpoint detection platforms should incorporate the domain and its associated IP into blocklists.

Continuous monitoring of the Cloudflare nameserver records is advised, as the attacker may shift hosting or add sub‑domains. Organizations should also update URL filtering rules to include the domain, and incident response teams should be prepared to investigate any credential‑theft attempts that reference fnlocker.info. Until further analysis (e.g., page content or SSL certificate inspection) becomes available, the default posture should be to block and alert on any traffic to this domain.