fogolend[.]com

fogolend.com is an active high‑risk generic phishing site observed on 12 July 2026. The domain was registered on 21 February 2026 through NameCheap, Inc. and is hosted behind Cloudflare’s network (AS13335) with the IP address 172.67.150.64 located in the United States. DNS resolution uses the Cloudflare nameservers nero.ns.cloudflare.com and susan.ns.cloudflare.com. The site presents a page titled “Fogolend | Borrow and Lend on Fogo” and serves content over TLS using a Google Trust Services / WE1 certificate, indicating a valid HTTPS connection. Front‑end technologies identified include React, Google Analytics, and Cloudflare Browser Insights, confirming the use of modern web frameworks. Reputation metrics are extremely poor: Gridinsoft assigns a trust score of 0 / 100, the domain is listed on one known security blocklist, and PhishDestroy has already blocked it. VirusTotal analysis shows that 1 of 93 security vendors flagged the domain, reinforcing the malicious assessment. An HTTP GET returns status code 200, suggesting the page is reachable and actively serving content. Available intelligence does not disclose the specific phishing vector, credential collection method, or any malicious payload beyond the deceptive branding of “Fogo.” Consequently, the precise user‑interaction flow remains uncertain. Defenders should immediately add fogolend.com to deny‑list rules for DNS and proxy filtering, monitor outbound traffic for connections to the IP 172.67.150.64, and enforce TLS inspection to capture any credential submissions. Continuous observation of the associated Cloudflare nameservers is recommended to detect potential changes in hosting or infrastructure. Given the high risk rating and confirmed malicious indicators, the domain should be treated as hostile until takedown confirmation.