harvestfx[.]com

The domain harvestfx.com is a confirmed phishing site engaged in brand impersonation targeting GoDaddy users. It presents itself as a legitimate GoDaddy service but is designed to harvest login credentials through social media phishing tactics. As of the latest verification, harvestfx.com has been taken offline, though it previously posed an elevated risk to users who may have interacted with it.

Technical analysis shows that harvestfx.com was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appeared on 1 security blocklist (PhishDestroy). The domain was registered through NameCheap, Inc. on August 1, 2017, and resolved to the IP address 2.19.224.60, hosted on Akamai Technologies infrastructure in Germany. The SSL certificate was issued by GoDaddy.com, Inc. under the 'Go Daddy Secure Certificate Authority - G2' chain. Technologies detected on the site included Node.js, Envoy, Express, HSTS, and Akamai, with a Gridinsoft trust score of 0/100. The observed page title was 'harvestfx.com', and nameservers included ns1.afternic.com and ns2.afternic.com.

Users who may have entered credentials on harvestfx.com should immediately change their GoDaddy passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or changes to settings. Report the phishing domain to GoDaddy’s abuse team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader takedown efforts.