site-language[.]us

On July 22, 2026, investigators observed that the domain site-language.us was registered on March 30 2026 through Web Commerce Communications Limited dba WebNic.cc. The domain resolves to the Cloudflare‑owned address 172.67.215.20 and uses the Cloudflare nameservers coleman.ns.cloudflare.com and mariah.ns.cloudflare.com, placing the infrastructure in Canada under Cloudflare, Inc. No SSL/TLS certificate was presented, indicating the site operated without HTTPS encryption. Page metadata revealed the title “FinStore UK,” and the intelligence feed categorizes the site as a “Fake Exchange” scam, suggesting it attempted to masquerade as a financial trading platform. Technical fingerprints show the use of Material Design Lite, Bootstrap, Cloudflare Browser Insights, and HTTP/3, all typical of a quickly assembled front‑end.

VirusTotal recorded a single positive detection out of 94 scanning engines, while Gridinsoft assigned a trust score of 0 / 100. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Current status is offline, but the presence on blocklists indicates prior malicious activity.

Uncertainties remain regarding the exact payload or credential‑harvesting mechanisms employed, as the site content has not been captured and the lack of SSL prevents inspection of traffic. Defenders should therefore pre‑emptively deny resolution of site-language.us at the DNS layer, enforce URL filtering based on the known blocklist identifiers, and monitor Cloudflare‑associated IP 172.67.215.20 for any resurgence of malicious services. Security teams should also alert end‑users that communications referencing “FinStore UK” may be fraudulent, and incorporate the domain indicator into threat‑intel feeds to improve detection across endpoint and network controls.