fchat[.]icu

This domain, fchat.icu, is identified as a credential theft phishing site designed to harvest user login credentials through deceptive interfaces. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the infrastructure aligns with known credential harvesting tactics. The site employs social engineering techniques to mimic legitimate chat or communication platforms, tricking users into submitting sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. Infrastructure analysis reveals the domain was registered through FewMoreTaps OÜ on April 24, 2026, and resolves to the IP address 172.67.132.161. Detection metrics show 5 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on one security blocklist. The domain is also blocked by at least one proprietary threat intelligence feed. Technologies detected include Node.js and Express for backend operations, with Cloudflare and Cloudflare Browser Insights employed for traffic routing and analytics, suggesting an attempt to obfuscate the origin and monitor victim interactions. As of the latest assessment, fchat.icu has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, the elevated risk level persists due to the domain's recent registration and historical association with malicious activity. Users who may have interacted with the site are advised to reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication where available, and monitor financial or communication platforms for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.