clartefinelya-nl[.]live

The domain clartefinelya-nl.live has been identified as a phishing platform specifically targeting users of Clarté Finelya, a purported AI-supported trading service. This domain is currently offline but was previously active in fraudulent operations designed to mimic the legitimate Clarté Finelya brand. Analysis indicates the site was engineered to deceive visitors into engaging with malicious financial services under the guise of artificial intelligence-assisted trading. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 26, 2026, an unusually future-dated registration that may indicate suspicious activity. It resolves to the IP address 104.21.47.88, a Cloudflare-protected endpoint commonly used to obscure hosting origins. The domain appears on two security blocklists and is flagged by 5 of 95 security vendors on VirusTotal, including detections from PhishDestroy and OISD. The Gridinsoft trust score for this domain is 0 out of 100, reflecting a complete lack of credibility. Technical indicators include the use of Let’s Encrypt SSL certificates, jsDelivr for content delivery, jQuery for scripting, and Cloudflare Browser Insights for analytics, all of which are consistent with modern phishing infrastructure. At present, clartefinelya-nl.live has been taken offline, likely due to enforcement actions or abandonment by the threat actors. However, the domain’s registration remains active, posing a potential risk for future misuse. Organizations and individuals are advised to block the domain and its associated IP address (104.21.47.88) at the network level. Security teams should monitor for any re-emergence of the domain or similar variations, particularly those leveraging the Clarté Finelya brand. Users who may have interacted with the site should immediately revoke any credentials shared and conduct a thorough review of their financial and digital accounts for signs of compromise.