fbmeta[.]kuruzz[.]cyou

This domain, fbmeta.kuruzz.cyou, operates as a cryptocurrency phishing site specifically designed to impersonate a USDT service center under the guise of Vortix Global. The page title, 'Vortix Global | USDT Service Center,' suggests an attempt to deceive users into believing they are interacting with a legitimate cryptocurrency platform, likely to harvest credentials, private keys, or facilitate unauthorized transactions. The use of cryptocurrency-themed phishing is particularly concerning due to the irreversible nature of blockchain transactions, which can result in immediate and permanent financial loss for victims. Analysis indicates that fbmeta.kuruzz.cyou was registered on April 24, 2026, through the registrar Gname.com Pte. Ltd. The domain resolves to the IP address 172.67.216.51 and employs Cloudflare for content delivery and protection, including HTTP/3 and HSTS technologies, which may obscure malicious activity from basic detection methods. A Let's Encrypt SSL certificate is present, providing a false sense of security to visitors. Security vendor detection on VirusTotal is limited, with only 2 out of 95 engines flagging the domain as malicious. Additionally, the domain appears on one security blocklist, and it has been blocked by at least one threat intelligence provider. Users who have visited fbmeta.kuruzz.cyou or interacted with its content should immediately cease all engagement and revoke any permissions granted to the site. If credentials or private keys were entered, affected parties must transfer assets to new wallets and monitor their accounts for unauthorized transactions. It is also recommended to scan local devices for malware, as phishing sites may deploy additional payloads. Given the domain's offline status, users should remain vigilant for similar phishing attempts targeting cryptocurrency services, particularly those leveraging Cloudflare infrastructure and free SSL certificates to appear legitimate.