finvorubit[.]net

This domain, finvorubit.net, poses a high-risk brand impersonation threat targeting cryptocurrency users through social engineering tactics. Analysis indicates the site mimics Binance, a major cryptocurrency exchange, to deceive visitors into disclosing sensitive credentials or transferring digital assets. The page title, 'FinvoruBIT™ - KI-Trading Deutschland 2025,' suggests a localized German-language campaign leveraging AI trading themes to appear legitimate, a common tactic in cryptocurrency fraud schemes.

Evidence supporting the malicious classification includes detection by 9 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging it for 'SOCIAL_ENGINEERING.' The domain is listed on four security blocklists and is blocked by multiple cryptocurrency security tools. Infrastructure analysis reveals it was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abuse. The domain resolves to the IP address 172.67.135.201, which has been linked to other suspicious activities in recent threat intelligence reports. Additionally, a trust score of 0/100 from Gridinsoft further corroborates its classification as high-risk.

Users who visited finvorubit.net should immediately cease all interaction and assume their credentials or financial details may have been compromised. It is recommended to revoke any active sessions, enable multi-factor authentication on legitimate accounts, and monitor for unauthorized transactions. If cryptocurrency was transferred, report the incident to the relevant exchange and local cybercrime authorities. Given the domain's current offline status, users should remain vigilant for similar phishing attempts using alternative domains or communication channels, such as email or social media.