fi-ae[.]info

This domain, fi-ae.info, is identified as a high-risk credential harvesting phishing site targeting financial sector users. Analysis indicates the domain is currently offline, though prior activity involved impersonating legitimate banking or payment platforms to harvest login credentials, payment details, or personal identifiable information (PII). No specific brand impersonation was confirmed, but the infrastructure aligns with generic financial phishing campaigns. Infrastructure analysis reveals the domain was registered through IONOS SE on February 21, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. It resolves to IP address 217.160.0.200, hosted on AS8560 (IONOS SE) in Germany, and lacks an SSL certificate, increasing susceptibility to man-in-the-middle attacks. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by 10 of 95 security vendors on VirusTotal. The absence of encryption, combined with the domain's presence on multiple blocklists, underscores its high-risk classification. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, historical activity and infrastructure patterns suggest potential for re-emergence under a similar or altered domain. Recommended actions include blocking the domain and its resolving IP (217.160.0.200) at the network perimeter, updating endpoint protection signatures to include this indicator, and monitoring for newly registered domains with similar naming conventions or hosting patterns. Organizations should also verify user exposure by checking logs for connections to fi-ae.info or its associated IP address and initiate password resets for any affected accounts.