fincpa76[.]ru

The domain fincpa76.ru has been identified as part of a credential theft campaign targeting users involved in CPA (Cost Per Action) networks. The site displays the title 'FinCpa — партнёрская CPA-сеть', indicating an attempt to impersonate a legitimate CPA affiliate platform. There is no evidence of a crypto drainer kit present on the infrastructure, but the branding and presentation suggest the intent to collect login or sensitive information from unsuspecting users within the affiliate marketing community.

Technical analysis of the domain reveals several indicators. The domain is registered through TIMEWEB-RU and resolves to IP address 109.61.108.206. The SSL certificate is issued by Let's Encrypt, providing basic encryption but not establishing any trust in legitimacy. VirusTotal currently reports 0 out of 95 security engines flagging this domain, indicating it has not yet been widely detected or blocklisted. The domain was created on May 15, 2026, and at the time of analysis, it remains active. No Google Safe Browsing or major blocklist entries are currently reported, further suggesting that the campaign is in its early stages or has evaded automated detection so far.

Given the site’s ongoing activity and niche targeting, there is an elevated risk of credential compromise for users involved in CPA networks who may mistake the site for a legitimate partner. Immediate response actions should include monitoring for new detection signatures, reporting the domain for further review, and alerting potential targets within the affiliate marketing ecosystem. Users are strongly advised not to enter any credentials on fincpa76.ru and to verify the authenticity of any CPA network platforms through official channels. Continued monitoring is recommended as the threat actor may pivot or expand operations before widespread detection occurs.