fusser[.]app

This domain, fusser.app, is actively flagged as a high-risk phishing operation targeting users with a fraudulent AI-powered team collaboration platform. Analysis indicates the domain was registered on March 6, 2026, and currently resolves to the IP address 104.21.71.225. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, which are commonly employed to obscure hosting origins and evade detection. The domain is listed on four security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware, and appears in 24 threat intelligence pulses on AlienVault OTX, signaling widespread recognition of its malicious nature. The page title, 'Fusser - AI-Powered Team Collaboration Platform,' suggests an attempt to impersonate a legitimate productivity tool, though the exact content and mechanics of the phishing scheme remain unconfirmed. Security vendors on VirusTotal have flagged the domain, with 4 out of 95 engines identifying it as malicious. The SSL certificate is issued by Google Trust Services, a common practice among threat actors to lend an appearance of legitimacy. The domain was registered through NiceNIC International Group Co., Limited, a registrar frequently associated with abusive domains. While the specific target or intended victim profile is not explicitly identified in available intelligence, the combination of AI-themed branding and collaboration platform mimicry suggests an effort to exploit corporate or remote-work environments. Defenders should treat this domain as an active threat and implement blocking measures at the network and endpoint levels. Given its presence on multiple blocklists and consistent detection by security tools, organizations are advised to monitor for any connections to 104.21.71.225 or related infrastructure. Further analysis of the site’s content and payload delivery mechanisms is recommended to determine the full scope of the phishing campaign.