user[.]finnova-limited[.]net

This domain, user.finnova-limited.net, is flagged as a crypto credential theft operation targeting users through a fraudulent portal impersonating FINNOVA LIMITED. Analysis indicates the site mimics legitimate financial or cryptocurrency services to harvest wallet credentials, likely enabling unauthorized access to digital assets. No specific drainer kit signatures were identified, but the use of Vue.js and Cloudflare infrastructure suggests a structured phishing framework designed for scalability and evasion. Infrastructure analysis reveals the domain was registered on July 31, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to IP address 172.67.185.253, hosted behind Cloudflare, which obscures direct server attribution. VirusTotal detection shows 3/95 security vendors flagging the domain as malicious, while it appears on three security blocklists, including MetaMask and SEAL. The SSL certificate, issued by Google Trust Services, provides a false sense of legitimacy, a common tactic in credential theft campaigns. Gridinsoft and Scamadviser trust scores of 0/100 and 41/100, respectively, further corroborate its malicious classification. The domain is currently offline, likely due to takedown actions or voluntary suspension by the threat actor. However, residual risk remains, as associated infrastructure (e.g., IP, registrar, or SSL certificate) may be repurposed for future campaigns. Users who interacted with this domain should immediately revoke any wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations are advised to block the domain and IP at the network level, and security teams should correlate this indicator with internal logs to identify potential compromise. Continuous monitoring of newly registered domains under the same registrar or IP range is recommended to preempt similar threats.