fogochain[.]run

fogochain.run is a generic phishing domain that was used to host a cryptocurrency airdrop scam, posing as the FogoChain project to trick users into connecting their wallets and claiming tokens. The site, which displayed the title 'FogoChain Airdrop | Check Eligibility and Claim Tokens,' has been taken offline. It posed a specific threat of credential or wallet theft, as no drainer kit was identified, but the domain was designed to harvest sensitive information from victims.

Technical indicators confirm the malicious nature of fogochain.run. VirusTotal reports 2 of 95 security vendors flag the domain, including Gridinsoft and SOCRadar. The domain was created on February 21, 2026, and resolves to IP address 104.21.86.15, hosted in the US by Cloudflare (AS13335). It appears on 4 security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The SSL certificate was issued by WE1. Google Safe Browsing did not flag the domain, but Gridinsoft assigned a trust score of 0 out of 100. The registrar is not available.

Users who interacted with fogochain.run should take immediate safety steps. Since this was a cryptocurrency phishing scam, revoke any token approvals granted to the site and move funds to a new, secure wallet. Change passwords for any accounts that may have been compromised, enable two-factor authentication, and monitor for fraudulent activity. Report the domain to relevant authorities or blocklist operators to help protect others from similar threats.