ff-io-exchange[.]com

PhishDestroy has flagged ff-io-exchange.com as an active credential theft domain designed to harvest credentials under the FASTPANEL brand. The site poses as a web-hosting control panel login page to trick administrators into submitting login details, which are then exfiltrated to attacker-controlled servers. Technical indicators reveal the domain was registered on April 23, 2026 through Dynadot Inc and resolves to IP 176.125.242.151, which currently hosts a fake FASTPANEL login interface to capture user credentials. Analysis of the domain shows zero detections on VirusTotal as of the latest scan, highlighting the challenge of early detection for emerging threats. The hostname ff-io-exchange.com was created just days prior to this report, suggesting a hastily deployed campaign. While no public blocklists currently flag the domain, the page title 'FASTPANEL' and SSL certificate alignment with the impersonated brand indicate a deliberate attempt to deceive users familiar with the legitimate FASTPANEL control panel. Users who visited ff-io-exchange.com should immediately change any credentials entered on the page, enable multi-factor authentication on their actual FASTPANEL accounts, and scan local devices for malware. Admins should block the domain at the network level and monitor for suspicious login attempts. Report any interactions with ff-io-exchange.com to PhishDestroy for further analysis and consider revoking any exposed API keys or session tokens. The low detection count emphasizes the need for proactive security measures beyond traditional antivirus solutions.