dxec3v0rf[.]fcnieos[.]com

Analysis of the domain dxec3v0rf.fcnieos.com indicates an active phishing infrastructure targeting users of the FCN platform. The domain was registered on April 22, 2026, through Dynadot Inc and is currently resolving to the IP address 104.21.35.224, hosted on Cloudflare’s network in California. The page title displayed is 'FCN,' suggesting an attempt to impersonate the legitimate FCN service. As of July 12, 2026, the domain returns an HTTP 200 status, confirming the phishing page remains accessible and operational. Infrastructure review reveals the use of Cloudflare nameservers (macy.ns.cloudflare.com and watson.ns.cloudflare.com) and a Let’s Encrypt SSL certificate (serial E7), which provides HTTPS encryption but does not validate the site’s legitimacy. Seven out of ninety-five security vendors on VirusTotal have flagged this domain, and it appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. The domain holds a trust score of 0/100 from Gridinsoft, reinforcing its classification as malicious. While the exact phishing kit or targeted brand remains unconfirmed, the consistent use of Cloudflare infrastructure and the domain’s recent registration align with patterns observed in credential-harvesting campaigns. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS and network layers. Security teams are advised to monitor for connections to 104.21.35.224 and review logs for any interaction with dxec3v0rf.fcnieos.com, particularly in environments where FCN-related services are used. Given the domain’s continued activity, users should be alerted to avoid entering credentials or sensitive data on any page associated with this address.