fusser[.]io

The domain fusser.io has been identified as a generic phishing resource targeting users of enterprise collaboration platforms. Analysis indicates the domain was actively impersonating an AI-powered team collaboration service, though it is currently offline. The threat type is classified as credential harvesting and fraudulent software distribution, with no legitimate affiliation to any known productivity suite or cloud service provider. Infrastructure analysis reveals the domain was registered on March 06, 2026, through NiceNIC International Group Co., Limited. It resolved to the IP address 172.67.204.156 and was protected by a Cloudflare proxy, utilizing HTTP/3 and Cloudflare Browser Insights for performance monitoring. The SSL certificate was issued by Google Trust Services, a common practice among phishing operators to mimic legitimacy. Detection metrics show the domain was flagged by 5 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. The domain appears on three distinct security blocklists and was actively blocked by multiple threat intelligence feeds. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with the resource prior to its deactivation. Organizations are advised to update endpoint protection rules to include the domain and associated IP in denylists. Network administrators should review logs for connections to 172.67.204.156 between March and April 2026, particularly from systems accessing enterprise collaboration tools. Users should be educated on recognizing impersonation tactics in software-as-a-service contexts, with emphasis on verifying domain registration dates and SSL certificate authorities during authentication workflows.