kz-finance-system[.]info

The domain kz-finance-system.info was registered on March 23 2026 through Dynadot Inc. It resolves to the Cloudflare‑owned address 104.21.82.58, which is geolocated to Canada. The authoritative nameservers are ashley.ns.cloudflare.com and jasper.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. The site presents a TLS certificate issued by Let’s Encrypt (E8), confirming that HTTPS is enforced but that the certificate is publicly available and not indicative of legitimacy. The page title returned by the server is “KZ Finance System → Главная”, suggesting a Russian‑language front‑end. Automated analysis detected the presence of third‑party libraries and services including Unpkg, jsDelivr, Cloudflare Browser Insights, AOS and HTTP/3, all of which are common in legitimate sites but also frequently leveraged by malicious actors to hide payloads.

Gridinsoft’s trust scoring engine assigns a score of 0 out of 100, reflecting an extremely low reputation. Threat intelligence flags the domain as a “Fake Exchange” phishing campaign. It appears on three independent security blocklists and is currently blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports that one of ninety‑four scanning engines flagged the domain, providing additional corroboration of malicious intent. Despite these indicators, the limited public scanning coverage leaves many details of the page content and credential‑harvesting mechanisms unverified.

Defenders should treat kz-finance-system.info as high‑risk. Network‑level controls ought to block outbound connections to the IP 104.21.82.58 and to the associated Cloudflare nameservers. Email filters should quarantine messages that reference the domain or contain the exact page title string. Endpoint security solutions should incorporate the domain into their URL reputation lists and monitor for any process that loads resources from Unpkg or jsDelivr when communicating with this host.