lsifinance[.]cfd

The domain lsifinance.cfd is a phishing site engaged in brand impersonation targeting the Solana cryptocurrency ecosystem. It presented itself as a cryptocurrency exchange under the title 'MORI ↔ SOLANA Обменник' but was designed to deceive users into transferring funds or disclosing sensitive information. No drainer kit was identified, yet the site posed an elevated risk due to its fraudulent representation of the Solana brand. As of the latest verification, lsifinance.cfd has been taken offline.

Technical indicators confirm the malicious nature of lsifinance.cfd. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and Seclookup, with a Gridinsoft trust score of 0/100. It appeared on 1 security blocklist, specifically PhishDestroy. Registered through Web Commerce Communications Limited on June 01, 2025, the domain resolved to the IP address 104.21.87.76, hosted by Cloudflare, Inc. (AS13335) in the US. No SSL certificate was available, and the domain used a single nameserver. Google Safe Browsing did not flag the site at the time of analysis.

Users who interacted with lsifinance.cfd should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new wallet. If credentials or private keys were entered, change passwords for all associated accounts and enable two-factor authentication. Monitor transaction histories for unauthorized activity and report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand’s security team. Victims may also file complaints with local cybercrime units or organizations like the Internet Crime Complaint Center (IC3).