finscuria[.]com

Analysis of finscuria.com indicates a phishing domain targeting digital banking users, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through Cosmotown, Inc., with nameservers hosted by LyteHosting (dns1.lytehosting.com to dns4.lytehosting.com). It resolves to IP 163.61.188.5, located in the United States under AS153568 (NEW DHAKA HARDWARE), an autonomous system not typically associated with financial services infrastructure. The site's page title, 'Finscuria - Dedicated to innovating, simplifying, and humanizing digital banking,' suggests an attempt to impersonate a legitimate banking platform, though the exact brand being mimicked remains unconfirmed due to limited content analysis. Technical indicators reveal the use of Bootstrap, LiteSpeed, GSAP, OWL Carousel, and jQuery, alongside HTTP/3, a common stack for modern phishing sites aiming to appear credible.

The domain is flagged by two of 93 security vendors on VirusTotal and appears on one security blocklist (PhishDestroy), contributing to an elevated risk assessment. Gridinsoft assigns a trust score of 0/100, further signaling malicious intent. The SSL certificate is issued by Let's Encrypt (R13), a neutral factor as free certificates are standard for both legitimate and fraudulent sites. Defenders should treat this domain as compromised infrastructure.

The combination of a recent registration, hosting on a non-banking ASN, and detection by security vendors warrants blocking at the network level. While the site is currently offline, monitoring for reactivation or migration to new IPs is recommended. No evidence links this domain to specific phishing kits or targeted brands beyond the banking-themed page title, so additional context—such as email campaigns or user reports—would clarify the attack vector.