futuresffgt[.]com

This domain, futuresffgt.com, is actively engaged in credential harvesting operations targeting cryptocurrency exchange users. Analysis indicates the infrastructure is designed to impersonate legitimate trading platforms, presenting fraudulent login interfaces to capture usernames, passwords, and two-factor authentication codes. The threat extends to potential wallet-draining attacks, where stolen credentials may be used to initiate unauthorized transactions or extract private keys from connected wallets. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 04, 2026, through GMO Internet, Inc., and currently resolves to 104.21.65.67, an IP address hosted by Cloudflare, Inc. (AS13335). Security vendors have flagged the domain, with 5 out of 95 engines on VirusTotal detecting it as malicious. Additionally, futuresffgt.com appears on three independent security blocklists, and its SSL certificate (Let's Encrypt, serial number E7) follows patterns commonly observed in phishing campaigns. The domain remains active as of this report, with no takedown actions observed. Users who have visited futuresffgt.com or entered credentials on any page hosted under this domain should assume their account information has been compromised. Immediate actions include revoking access to any linked wallets or exchange accounts, enabling new two-factor authentication methods, and monitoring for unauthorized transactions. If cryptocurrency addresses or private keys were exposed, users should transfer assets to new, secure wallets. System scans for malware are recommended, as phishing sites may deploy additional payloads. Organizations should update blocklists to include this domain and its associated IP address to prevent further access.