fake[.]fvia[.]io

The domain fake.fvia.io is identified as a credential theft infrastructure specializing in the distribution of fraudulent payment slip tools. Analysis of the page title, "Fake Bill Chuyển Khoản - Công cụ fake bill chuyển khoản chuẩn dùng để seeding," confirms its intent to facilitate the creation of counterfeit transaction records, likely for seeding phishing campaigns targeting financial institutions or individuals. The domain is currently offline, though prior activity indicates a focused effort to harvest sensitive financial data under the guise of legitimate payment documentation. Infrastructure analysis reveals the domain was registered on March 04, 2025, through HOSTINGER operations, UAB, and resolves to the IP address 188.114.97.3. Security vendors on VirusTotal flagged the domain, with 2 of 95 detecting malicious activity. The domain appears on one security blocklist and holds a trust score of 0/100. Technical indicators include the use of PHP, Chart.js, Alpine.js, SweetAlert2, reCAPTCHA, OWL Carousel, Moment.js, and jsDelivr, alongside a Let's Encrypt SSL certificate. These components suggest a dynamic, interactive interface designed to mimic legitimate financial tools while obscuring malicious functionality. The current offline status of fake.fvia.io does not eliminate the risk posed by similar credential theft infrastructure. Organizations and individuals are advised to block the domain and its associated IP at the network level, monitor for related indicators of compromise, and educate users on recognizing fraudulent payment requests. Financial institutions should implement multi-factor authentication for transaction verification and conduct retrospective reviews of recent payment activity for anomalies. Given the domain's recent creation and targeted nature, heightened vigilance is recommended for entities operating in regions where the Vietnamese language is prevalent, as the tool appears tailored for local or regional phishing campaigns.