fiona-v7[.]top

PhishDestroy identifies active credential harvesting infrastructure on the domain fiona-v7.top, masquerading as the legitimate React scaffolding tool 'Create Next App'. The site serves as a generic phishing entry point designed to trick developers into submitting authentication tokens or API keys under the guise of a routine setup process. No specific drainer kit payload is observed in current telemetry, suggesting the campaign relies on a lightweight landing page that forwards stolen data to a backend collection server. The threat infrastructure is anchored by the domain fiona-v7.top, which was registered on May 14, 2026 through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn). The domain resolves to IP address 172.67.140.103 and utilizes a valid Let's Encrypt SSL certificate to enhance appearance of legitimacy. VirusTotal analysis indicates minimal detection coverage with only 1 out of 95 security vendors flagging the domain as malicious as of the latest scan window. The domain has not been flagged by Google Safe Browsing (GSB) and currently shows zero listings on public blocklists, indicating a newly emerged or stealthily operating campaign. As of the last intelligence update, the campaign is classified as active with an elevated risk profile. Immediate defensive actions include blocking the domain at DNS and network levels using indicator fiona-v7.top and IP 172.67.140.103. Users are advised to avoid visiting the site and inspect development tooling workflows for unexpected redirections or authentication prompts. Remaining risk is assessed as moderate due to low detection coverage and recent domain registration, allowing for potential expansion if undetected. Continuous monitoring is recommended to identify associated infrastructure or updated payload delivery mechanisms.