finviora[.]net

This domain, finviora.net, is flagged as an active credential phishing site targeting Italian-speaking users under the guise of an official cryptocurrency platform. Analysis of the page title, 'Finviora - L'unico Sito Web Ufficiale in Italia [2026],' suggests an attempt to impersonate a legitimate financial service, likely exploiting users through fake login portals or wallet drainer kits. The infrastructure shows no direct evidence of known drainer kits, but the use of tracking technologies like Facebook Pixel and Cloudflare Browser Insights indicates a focus on user behavior monitoring and conversion optimization typical of phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain has a VirusTotal detection score of 0/95, indicating no current antivirus flagging despite its malicious intent. It was registered on March 22, 2026, through Dynadot Inc, and resolves to the IP address 188.114.97.3. The SSL certificate is issued by Let's Encrypt, providing a veneer of legitimacy. The domain appears on 3 security blocklists, including MetaMask and PhishDestroy, and is categorized as a generic phishing threat. Google Safe Browsing status is not explicitly provided but is likely flagged given the blocklist appearances. Current status remains active and under investigation, with no takedown or sinkholing actions observed as of this analysis. The domain continues to resolve and may still be targeting users through search engine manipulation or malvertising. Remaining risks include potential credential harvesting, wallet compromise, or malware distribution via fake updates. Users are advised to avoid interaction with the domain, verify SSL certificates independently, and cross-reference official communications from legitimate financial platforms. Network administrators should consider blocking the IP 188.114.97.3 and monitoring for related domains registered through the same registrar.