fifaco[.]sbs

Analysis of the domain fifaco.sbs reveals a high-risk phishing infrastructure targeting cryptocurrency users. The domain was registered on June 9, 2026, through NameSilo, LLC, and currently resolves to the IP address 104.21.44.182. Google Safe Browsing has flagged this domain for social engineering, indicating an intent to deceive users into divulging sensitive information. Security vendors have detected malicious activity, with 14 out of 91 engines on VirusTotal identifying the domain as suspicious.

The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, suggesting a coordinated effort to mitigate its impact. Infrastructure analysis indicates the domain leverages Cloudflare hosting, as evidenced by its IP resolution, which may obscure the true origin of the malicious activity. The registration details and hosting provider do not provide additional indicators of compromise beyond the established phishing classification. No specific brand impersonation or phishing kit has been confirmed in the available data, though the presence of MetaMask among the blocking entities suggests a likely focus on cryptocurrency wallet credentials.

Defenders should treat this domain as an active threat. Immediate actions include blocking the domain and its associated IP at the network level, updating endpoint protection signatures, and alerting users to the risks of interacting with fifaco.sbs. Given the domain's recent registration and active detection by multiple security vendors, continuous monitoring for related infrastructure or newly registered lookalike domains is recommended. The exact content and targeting of the phishing pages remain unconfirmed, but the available evidence supports a high-risk classification for this domain.