pc[.]fnxgitrurous[.]cc

This domain, pc.fnxgitrurous.cc, is actively serving a phishing kit targeting the FXGT brand as of July 12, 2026. Infrastructure analysis reveals the domain was registered on August 9, 2025, through Gname.com Pte. Ltd., and is currently resolving to 188.114.96.3, an address within AS13335 operated by Cloudflare. The site returns an HTTP 403 status, though front-end technologies including Ant Design, Vue.js, and Cloudflare Browser Insights remain detectable, suggesting the kit is still deployed despite access restrictions. Five out of ninety-five security vendors on VirusTotal have flagged pc.fnxgitrurous.cc, while three independent blocklists—PhishDestroy, MetaMask, and SEAL—have already classified it as malicious. The domain’s trust score is recorded at 0/100, reinforcing its high-risk classification. Cloudflare nameservers (kia.ns.cloudflare.com and nicolas.ns.cloudflare.com) are in use, providing the operator with DDoS protection and IP masking, which complicates takedown efforts. Defenders should note that the phishing page title explicitly mimics FXGT, a financial trading platform, indicating an intent to harvest credentials or payment details. The use of HTTP/3 and modern JavaScript frameworks suggests the kit is designed to evade simple signature-based detection. While the domain remains active, its 403 status may indicate either a temporary access control measure or an attempt to evade automated scanners. Organizations are advised to block traffic to 188.114.96.3 and monitor for any DNS queries to pc.fnxgitrurous.cc within internal logs. Given the domain’s recent creation and continued presence on blocklists, it is likely to persist or resurface under similar naming conventions. Security teams should correlate this indicator with any recent user reports of FXGT-themed phishing attempts to assess potential compromise.