fortifib[.]com[.]nuviab[.]com

Analysis indicates that the domain fortifib.com.nuviab.com was registered on 21 February 2026 through Dynadot Inc. The site resolves to the IPv4 address 198.12.80.250, which belongs to AS36352 hosted by HostPapa in the United States. The domain serves an HTTP 200 response and presents the page title “Fortifi Bank | Online Banking & Financial Services,” suggesting an attempt to masquerade as an online banking portal. The SSL certificate is identified as “R12,” and the Gridinsoft trust score is 0/100, indicating a malicious reputation. The domain is listed on one security blocklist and has been blocked by PhishDestroy. VirusTotal reports 10 of 93 scanning engines flagging the site, confirming malicious activity. The infrastructure uses the nameservers 5014.ns1.abovedomains.com and 5014.ns2.abovedomains.com. The threat is classified as a brand impersonation linked to a crypto scam. Uncertainty remains regarding the exact content delivered to victims, as no direct page content has been examined. Defenders should add the domain and its IP address to block lists, monitor DNS queries for the associated nameservers, and enforce outbound traffic controls to prevent connections to the host. Continuous re‑scanning with multiple threat intel platforms is recommended to capture any changes in the malicious profile.