pc[.]fxcmsafeltd[.]cc

The domain pc.fxcmsafeltd.cc is flagged as a generic phishing site. It appears to impersonate the brand FXCM Safe, suggesting a potential effort to deceive users into trusting the site and entering sensitive information. There is no indication of a specific crypto drainer kit or malware being used, but the threat type suggests a fake login page designed to capture credentials.

Infrastructure analysis reveals that the domain has been flagged by 13 out of 95 security vendors on VirusTotal, indicating a moderate level of detection. The domain is registered through Gname.com Pte. Ltd., a registrar that has been associated with various suspicious and malicious activities. It resolves to the IP address 172.67.183.144, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on February 21, 2026, and it appears on one security blocklist, specifically PhishDestroy. Additionally, the SSL certificate is issued by Google Trust Services, which might be an attempt to appear more legitimate to unsuspecting users.

The domain is currently offline, which may indicate that it has been taken down by security measures or abandoned by the threat actors. However, the presence of the domain on a security blocklist and the moderate detection rate by security vendors suggest that it poses a significant risk. Users are advised to avoid this domain and ensure that any credentials or sensitive information are only entered on verified and secure websites. Security teams should monitor the domain for any signs of reactivation and consider implementing additional protective measures, such as DNS blocking or user education, to mitigate the risk of future phishing attempts.