finmex[.]icu

finmex.icu was registered on 28 February 2026 through NiceNIC International Group Co., Limited and assigned Cloudflare nameservers heidi.ns.cloudflare.com and norm.ns.cloudflare.com. The domain resolves to IP 188.114.97.3, which is part of AS13335 operated by Cloudflare, Inc. The IP is geolocated to the United States. No TLS certificate was observed, indicating that the site was served over plain HTTP. The only visible page element is the title "finmex.icu/". VirusTotal analysis recorded seven detections out of ninety‑three scanners, and the domain is listed on a single external blocklist.

PhishDestroy has already taken the domain offline and marks it as taken down. The lack of SSL, limited detection coverage, and the short lifespan of the domain suggest a typical disposable phishing infrastructure. However, the exact content, targeted brand, or phishing kit used has not been publicly disclosed, leaving the attack vector and victim profile uncertain. Defenders should add 188.114.97.3 and finmex.icu to network and DNS allow‑list exclusions, ensure that web filtering solutions reference the current blocklist entry, and monitor Cloudflare‑hosted IP ranges for re‑registration of the domain or similar variants.

Continuous vigilance on the registrar NiceNIC for new registrations resembling finmex.* is advised. Where possible, ingest the VirusTotal detection identifiers into SIEM correlation rules to surface any future activity that matches the observed indicator set. Because the site is offline, active probing is not possible, but historical logs should be examined for any client requests to the domain or its IP before the takedown. In summary, the domain represents an elevated‑risk phishing indicator that warrants immediate blocking and ongoing watch for resurgence.