fahcoit[.]com

This domain, fahcoit.com, is identified as a credential harvesting phishing site designed to deceive users into submitting login credentials through fraudulent web portals. Analysis indicates no direct association with a specific brand or drainer kit, though the infrastructure aligns with generic phishing campaigns targeting authentication data. The site operates without overt branding, relying on social engineering tactics to mimic legitimate services and capture sensitive information. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3 and is currently flagged by 7 out of 95 security vendors on VirusTotal. The domain appears on a single security blocklist and was actively blocked by at least one threat intelligence platform. No Google Safe Browsing (GSB) detections were recorded at the time of analysis, though the elevated risk level is supported by the vendor detection count and registrar history. As of the latest assessment, fahcoit.com has been taken offline, likely in response to security interventions or infrastructure takedowns. However, residual risk persists due to the domain's recent registration and the potential for re-emergence under altered infrastructure. Organizations are advised to monitor for related indicators, including the IP 188.114.97.3 and registrar patterns associated with NICENIC INTERNATIONAL GROUP CO., LIMITED. Users should verify domain authenticity before entering credentials and report suspicious activity to relevant security teams.