famousfinances[.]net

Analysis of the domain famousfinances.net, which was taken offline as of the report date, shows concrete indicators of a malicious credential‑ harvesting operation. The site hosted a page titled “Famous Finance‑ Premier Trading Platform” and employed the publicly known “Gambler Scam” phishing kit, a kit frequently used to simulate financial exchanges. The kit’s configuration aligns with the listed scam type “Fake Exchange”, confirming that the domain was intended to deceive victims into providing login details for a non‑existent trading platform. Technical reconnaissance reveals that the domain was registered on 3 March 2026 through Unstoppable Domains and resolves to the IP address 172.93.120.110, an address owned by Host4Geeks LLC (AS393960) in the United States.

No TLS certificate was presented, meaning the site operated over plain HTTP, a common characteristic of low‑cost phishing deployments. Nameserver records point to ns1.spantrix.com and ns2.spantrix.com, which are also associated with the same hosting provider. The domain appears on three independent blocklists—PhishDestroy, MetaMask, and SEAL—and Google Safe Browsing has flagged it for social engineering, reinforcing its malicious reputation. VirusTotal scans report that two of ninety‑five security vendors flagged the domain, providing additional, albeit limited, vendor corroboration.

Given the observed evidence, the primary uncertainty lies in the depth of victim impact, as no public breach data or credential dumps have been disclosed. Defenders should block the domain at network perimeter devices, update URL filtering services with the observed IP and hostnames, and monitor for any residual traffic to the associated nameservers. Incident response teams should also advise users to avoid any unsolicited communications referencing “Famous Finance” or related trading platforms, and to reset credentials if they suspect exposure.