fingogin[.]xyz

Analysis of fingogin.xyz reveals a confirmed phishing domain targeting cryptocurrency users through a fake airdrop scam. The domain was registered on April 28, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED, and is currently offline following detection. Infrastructure analysis shows the domain resolving to 188.114.97.3, an IP address assigned to CloudFlare, Inc. in Canada, with nameservers earl.ns.cloudflare.com and laura.ns.cloudflare.com, indicating Cloudflare protection. The SSL certificate is issued by Let's Encrypt (E7), a common choice for both legitimate and malicious sites, providing no inherent indication of trustworthiness. The page title, $FINGO Airdrop, directly names the fraudulent scheme, classifying it as an airdrop scam—a tactic frequently used to deceive users into disclosing wallet credentials or transferring funds under false pretenses.

Gridinsoft assigns a trust score of 0/100, reflecting high-risk categorization, while PhishDestroy has blocked the domain. The domain appears on one security blocklist, and two of 91 security vendors on VirusTotal flagged it as malicious prior to takedown. Detected technologies include Hostinger (likely the origin host), Cloudflare, Cloudflare Browser Insights, and HTTP/3, a stack consistent with low-cost, high-velocity phishing operations. No evidence suggests the domain was ever live on major Safe Browsing or OTX feeds, and the exact content beyond the page title remains unanalyzed.

The use of Cloudflare complicates origin tracing, though the hosting provider (Hostinger) may retain logs for law enforcement or abuse reporting. Defenders should treat any prior interaction with fingogin.xyz as a potential credential or asset compromise. Monitoring for related domains using the same registrar, nameservers, or IP range is recommended, as phishing actors frequently rotate infrastructure. The domain’s current offline status does not preclude future reactivation under altered configurations.