fcheck[.]shop

This domain, fcheck.shop, is currently active and flagged as a high-risk credential harvesting phishing site. Infrastructure analysis reveals it resolves to the IP address 193.187.110.3 and utilizes nameservers a.dnspod.com, b.dnspod.com, and c.dnspod.com, which are commonly associated with domains involved in phishing campaigns. As of July 15, 2026, two of ninety-one security vendors have detected this domain as malicious, indicating a confirmed but not yet widely recognized threat. The exact content or targeted brand of the phishing page remains unanalyzed, and no specific scam category (e.g., shipping, investment, or crypto-related) has been identified in available intelligence. Defenders should treat this domain as an active threat. Immediate actions include blocking the domain and its resolving IP at perimeter security controls, monitoring for connections to 193.187.110.3, and reviewing logs for any prior interactions. The use of DNSPod nameservers may warrant broader scrutiny of domains utilizing the same infrastructure, as this pattern is frequently observed in coordinated phishing operations. Further investigation into the domain’s hosting provider and associated autonomous system may reveal additional linked threats. Given the limited vendor detections, this domain may represent a newer or evasive campaign, and defenders should prioritize proactive hunting for related indicators.