financialexpertbnk[.]live

The domain financialexpertbnk.live has been identified as a credential theft operation impersonating a financial institution. Analysis indicates the site was designed to harvest login credentials from victims under the guise of a legitimate banking service, specifically mimicking the branding and interface of established financial entities. The domain is currently offline, but prior activity suggests a targeted campaign against users seeking banking or financial advisory services. Infrastructure analysis reveals the domain was registered through Dynadot LLC on March 10, 2026, and resolved to the IP address 198.251.84.200. It was flagged by 5 of 95 security vendors on VirusTotal, indicating detection by multiple threat intelligence sources. The domain appears on one security blocklist, and its trust score, as assessed by independent security metrics, is 0 out of 100. Technical indicators include the use of Bootstrap, LiteSpeed, Smartsupp, Slick, OWL Carousel, and jQuery, alongside HTTP/3 for enhanced performance. The site employed a Let's Encrypt SSL certificate, a common tactic to appear legitimate to unsuspecting users. The current status of financialexpertbnk.live is offline, though the infrastructure remains a potential risk for future malicious activity. Organizations and individuals are advised to block the domain and its associated IP address (198.251.84.200) at the network level to prevent accidental access. Users who may have interacted with the site should immediately reset credentials for any financial or sensitive accounts, enable multi-factor authentication where available, and monitor for unauthorized activity. Security teams should review logs for connections to the domain or IP and correlate with other credential theft indicators to assess potential compromise.