ranger-finance[.]app

Analysis of ranger-finance.app, created on 2026-02-21, shows that the domain is currently offline but was previously resolved to the IPv4 address 94.181.203.96. The IP resides in Russia and is advertised as part of AS41727, operated by JSC ER‑Telecom Holding. The site presented an SSL certificate identified as “R13,” indicating a possibly weak or self‑signed certificate. The page title retrieved during the brief live period was “$WIF | Literally just a dog with a hat.” No explicit brand or service was referenced in the title, and no additional content was captured for further attribution.

The domain appears on two independent security blocklists and has been actively blocked by PhishDestroy and ScamSniffer, reinforcing the assessment that it was being used for malicious purposes. VirusTotal scans recorded eight detections out of ninety‑five participating security vendors, demonstrating a moderate level of consensus among scanners that the domain is associated with unwanted activity. Gridinsoft assigned a trust score of 0 out of 100, indicating an extremely low reputation.

While the offline status limits real‑time verification, the combination of early registration, Russian hosting, low trust score, blocklist inclusion, and multiple vendor detections suggests the domain was part of a generic phishing or fraud campaign. Defenders should continue to block the domain at network perimeters, monitor for any re‑hosting attempts, and consider adding the IP address 94.181.203.96 to threat‑intel feeds. Ongoing observation of related AS41727 traffic is advised, as adversaries may reuse the same hosting infrastructure for future campaigns.