fql9vv96ku[.]tik58777[.]com

This domain, fql9vv96ku.tik58777.com, operates as a credential theft platform designed to harvest sensitive user data, including account logins and personal information. Analysis of the site’s infrastructure and content patterns indicates it employs deceptive login prompts or form submissions to trick visitors into disclosing credentials, which are then transmitted to attacker-controlled servers. The absence of legitimate branding or verifiable ownership further supports its classification as a fraudulent credential collection endpoint. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to the IP address 118.193.68.138, hosted under AS135377 (UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED) in South Korea. It was registered on November 07, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. Detection metrics show 20 out of 95 security vendors on VirusTotal flagging the domain as malicious, while two independent blocklists—PhishDestroy and PhishingDB—have explicitly listed it. The domain lacks an SSL certificate, increasing the risk of data interception during transmission. Users who visited fql9vv96ku.tik58777.com should assume their credentials or submitted data may have been compromised. Immediate actions include resetting passwords for any accounts entered on the site, enabling multi-factor authentication where available, and monitoring associated accounts for unauthorized activity. System scans using updated security tools are recommended to detect potential secondary infections. If financial or sensitive personal information was submitted, affected parties should report the incident to relevant authorities and consider credit monitoring services to mitigate downstream risks.