fasoollka-r[.]xyz

This domain, fasoollka-r.xyz, is currently engaged in credential theft phishing operations targeting end users. Analysis indicates the infrastructure is designed to harvest login credentials, financial details, or other sensitive personal information through deceptive web forms that mimic legitimate services. The domain employs social engineering tactics, such as fake login portals and urgent messaging, to induce victims into submitting confidential data. Given its high-risk classification and continued operational status, this domain poses a significant threat to individual and organizational security. Infrastructure analysis reveals the domain was registered on June 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 91.149.167.21, which has been linked to prior phishing activity. Detection metrics show that 2 out of 95 security vendors on VirusTotal have flagged fasoollka-r.xyz as malicious, a low but non-zero detection rate that suggests evasion techniques may be in use. Additionally, the domain appears in one threat intelligence pulse on AlienVault OTX, indicating limited but confirmed visibility within the security community. The SSL certificate, issued by Let's Encrypt, provides basic encryption but does not validate the legitimacy of the site. Users who have visited fasoollka-r.xyz or interacted with its content should take immediate remediation steps. First, any credentials entered on the site must be considered compromised and should be changed across all platforms where they were reused. Second, affected systems should be scanned for malware or unauthorized access, as phishing sites may deploy secondary payloads. Third, users should monitor financial and communication accounts for signs of unauthorized activity. Organizations are advised to block the domain and its associated IP address at the network level to prevent further exposure. Security teams should review logs for connections to 91.149.167.21 or requests to fasoollka-r.xyz to identify potentially compromised endpoints.