findp2pmainnet[.]app

Analysis of findp2pmainnet.app indicates an active crypto‑related phishing infrastructure. The domain resolves to 198.251.84.200, a server hosted in Luxembourg under FranTech Solutions, and returns HTTP 200 responses. Registration was performed on June 28 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, with authoritative name servers ns5.my‑control‑panel.com and ns6.my‑control‑panel.com. The site is secured with a Let’s Encrypt certificate (YR1) and operates on a LiteSpeed web server delivering WordPress, MySQL, PHP, jQuery, HTTP/3 and third‑party widgets such as Smartsupp and YouTube. Threat intelligence classifies the content as a crypto scam; the page title “Learning how to improve your knowledge and to promote Network” does not reveal a target brand. The domain has been blocked by PhishDestroy and appears on one external blocklist. Reputation scoring from Gridinsoft is 6 / 100, and 9 of 91 VirusTotal scanners have flagged the host, indicating malicious activity. While the exact phishing lure (e.g., credential collection page) has not been observed, the combination of a newly registered domain, low trust score, and confirmed blocklist entries suggests a high‑risk vector aimed at cryptocurrency users. Defenders should add the domain and its IP to outbound and inbound deny lists, monitor DNS queries for the associated name servers, and enable URL filtering for HTTP 200 responses from this host. Continuous re‑scanning of the site is advised to capture any payload changes, and incident response teams should treat any traffic from this domain as malicious.