fnscope[.]com

The domain fnscope[.]com was registered on 24 July 2026 through Dominet (HK) Limited and is currently resolving to the IPv4 address 193.187.110.3. Within hours of creation the domain appeared on a single public blocklist and was subsequently added to the PhishDestroy blocklist, indicating that at least one security provider has observed malicious activity associated with the host. DNS resolution is handled by three dnspod.com authoritative name servers (a.dnspod.com, b.dnspod.com, c.dnspod.com), a configuration frequently seen in fast‑flux or disposable‑domain campaigns. VirusTotal records show that the domain has been scanned by 91 antivirus and URL‑reputation engines, none of which have raised a detection at the time of analysis; the lack of a detection does not imply benign intent, especially given the domain’s recent creation and blocklist presence.

Infrastructure analysis confirms that the single IP address 193.187.110.3 is the sole endpoint serving content for fnscope[.]com, simplifying mitigation actions for defenders. No SSL certificate details, HTTP status codes, page title, or content metadata have been published, leaving the exact nature of the phishing payload unknown. The limited intelligence suggests a classic generic phishing campaign, but the specific target or lure cannot be confirmed without live site inspection.

Given the current evidence, security teams should treat fnscope[.]com as a high‑confidence phishing indicator. Recommended actions include adding the domain and its resolving IP to local blocklists, configuring DNS‑level denial for the three dnspod.com name servers, and continuing to monitor VirusTotal and other reputation services for any change in detection status. Because the domain is only days old, rapid propagation is possible; continuous threat‑intel feeds should be consulted for newly observed indicators such as payload URLs, credential‑stealing forms, or associated command‑and‑control infrastructure.