finanzzasbhd2025rd[.]imi[.]lat

This domain, finanzzasbhd2025rd.imi.lat, is identified as a high-risk generic phishing infrastructure targeting cryptocurrency users. Analysis indicates no direct association with a specific brand or drainer kit, though the naming convention suggests an intent to mimic financial or blockchain-related services. The domain exhibits characteristics typical of credential-harvesting or wallet-draining campaigns, commonly deployed in cryptocurrency phishing operations. Infrastructure analysis reveals the following technical indicators: the domain was registered on January 17, 2025, through Porkbun LLC and resolves to the IP address 77.72.1.44, hosted on AS12488 (Krystal Hosting Ltd) in the United Kingdom. Detection metrics show 19 out of 95 security vendors on VirusTotal flagging the domain as malicious. Google Safe Browsing explicitly classifies it as phishing, and it appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for both legitimate and malicious domains due to its accessibility. As of the latest assessment, finanzzasbhd2025rd.imi.lat has been taken offline, displaying a 'Domain Suspended' page. While the immediate threat appears mitigated, residual risk persists due to potential re-registration or migration to alternative infrastructure. Users who interacted with the domain prior to its suspension should assume credential or wallet compromise and take immediate remedial action, including revoking access to any linked services, rotating passwords, and monitoring for unauthorized transactions. Organizations are advised to update blocklists with the provided indicators to prevent future exposure.