fovcas[.]com

PhishDestroy identifies fovcas.com as an active generic phishing domain hosting a fake login portal intended to harvest user credentials. The site is currently unclassified by major threat intelligence platforms but exhibits clear indicators of malicious intent, including a recently registered domain and hosting on a known IP address. No specific brand was targeted in this campaign; instead, the page appears to impersonate a generic login interface, likely aiming to capture unsuspecting victims' usernames and passwords. The domain resolves to 104.21.36.193 and uses a Let's Encrypt SSL certificate, which adds a false veneer of legitimacy. This domain was flagged on March 31, 2026, with VirusTotal currently showing 4/95 detections. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for bulk domain registrations that are sometimes abused for malicious purposes. The site has not been added to Google Safe Browsing (GSB) or other major blocklists as of this analysis. Key technical indicators include the domain's recent creation date, reliance on a shared hosting IP (104.21.36.193), and the use of a legitimate SSL certificate to deceive users into trusting the page. The threat remains active and under investigation, with no official blocklist inclusion or takedown action recorded at this time. Users are advised to avoid interacting with fovcas.com and to verify any suspicious domains using PhishDestroy's threat intelligence database. Remaining risk is assessed as medium-high due to the domain's recent activation, lack of detection, and potential for further malicious activity. Security researchers are encouraged to monitor this domain for updates as the investigation progresses.