fucat-value[.]com

PhishDestroy identifies focat-value.com as an active crypto-draining phishing domain registered on June 18, 2023 through GMO Internet, Inc. The domain is engineered to mimic legitimate cryptocurrency platforms in order to trick users into connecting wallets and signing malicious transactions that silently drain funds. Security telemetry shows VirusTotal detections at 18/95 vendors, with no brand impersonation specified in current feeds; the infrastructure is provisioned for on-chain exfiltration rather than credential harvesting.

Forensic indicators are definitive: the domain resolves to IPv4 157.7.107.108 via a Let’s Encrypt SSL certificate, placing it on two global blocklists curated by PhishingArmy and OISD. Creation date is recent—June 18, 2023—indicating a fast-turnaround campaign leveraging disposable domains. The 18/95 VirusTotal score, while below absolute majority, still represents a significant minority of security engines recognizing malicious intent, and the presence on two independent blocklists elevates confidence in the classification as an elevated-risk crypto drainer.

Currently the domain remains active and unseized. No takedown notices are recorded in public feeds, and the sinkhole status is unknown. Users are advised to avoid interaction and verify any similar links using PhishDestroy’s live lookup before proceeding. Although the immediate threat is elevated, the combination of recent registration, low VT consensus, and small blocklist footprint suggests opportunistic targeting rather than large-scale distribution; nonetheless, continued monitoring is warranted as the campaign may escalate or pivot quickly.