finbridge[.]im

PhishDestroy identifies FinBridge.im as a live crypto drainer posing as a cross-chain bridge to steal deposited funds. This domain (finbridge.im) was flagged by PhishDestroy’s under-investigation pipeline and currently resolves to IP 188.114.96.3. The site holds a valid Let’s Encrypt SSL certificate, which attackers use to appear legitimate. As of the latest scan, the domain shows zero detections on VirusTotal (1/95 engines), underscoring how quickly fresh phishing infrastructure evades signature-based detection. Registrar records place the domain’s creation date in early 2024, indicating a recently stood-up lure rather than an aged domain repurposed for abuse. Historical telemetry shows the infrastructure has not yet accumulated a large blocklist footprint, making it harder for users to rely on community blocklists alone. Despite the low VT score, network telemetry confirms active redirection flows toward known crypto drainer endpoints, consistent with a credential-theft campaign targeting multi-chain wallet users. If you visited FinBridge.im or entered any wallet credentials, revoke connected permissions immediately via your wallet’s “Connected Apps” panel and transfer remaining assets to a clean wallet. Do not approve any token approval or transaction requests from unknown sites. Report the domain and any associated transaction hashes to your wallet provider and to PhishDestroy’s seed 2b3e56 for further analysis.