fergamb[.]cc

PhishDestroy identifies fergamb.cc as an active credential-harvesting domain engineered to trick users into surrendering sensitive login credentials. The site lures victims with spoofed login pages masquerading as legitimate services, capturing entered usernames and passwords for subsequent abuse in account takeovers and financial fraud. This campaign relies on social engineering and time-sensitive urgency to bypass suspicion and maximize victim yield before takedown efforts can begin.

This domain was flagged on VirusTotal with zero detections out of 95 engines as of the latest scan, indicating it currently evades most automated defenses. It resolves to IP address 104.21.4.41 and was registered on March 31, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED using a free Let’s Encrypt SSL certificate to appear trustworthy. These factors combine to create a low-detection, high-impact threat vector actively distributing malicious content.

If you visited fergamb.cc or entered any information, immediately change the passwords on all related accounts and enable multi-factor authentication where available. Run a full antivirus scan on your device and monitor financial accounts for unauthorized transactions. Report the domain to your security team or through local cybercrime reporting channels to help accelerate blocklisting and protect others from falling victim.