finvergetrust[.]com

Analysis of the domain finvergetrust.com indicates it was actively involved in a high-risk phishing campaign impersonating an investment platform. Registered on March 21, 2025, through Tucows Domains Inc., the domain resolved to the IP address 68.168.220.124, hosted by Interserver, Inc. (AS19318) in the United States. The domain's infrastructure utilized Nginx with OpenResty and employed nameservers DNS3004A.TROUBLE-FREE.NET and DNS3004B.TROUBLE-FREE.NET. A Let's Encrypt SSL certificate (R13) was present, suggesting an attempt to appear legitimate to potential victims.

The page title, 'FINVERGE TRUST – Safe investment with FINVERGE TRUST,' explicitly positioned the site as an investment service, though no specific brand impersonation was confirmed beyond the self-referential name. Detection metrics from July 2026 show the domain was flagged by 15 of 93 security vendors on VirusTotal and appeared on three security blocklists, including PhishDestroy, MetaMask, and SEAL. AlienVault OTX included the domain in one threat intelligence pulse, further corroborating its malicious classification. Trust scores from Scamadviser and Gridinsoft were 1/100 and 0/100, respectively, reinforcing its high-risk status.

As of the report date, the domain has been taken offline, though residual risk may persist for users who interacted with it prior to its removal. Defenders should treat any prior connections to 68.168.220.124 or finvergetrust.com as potential compromise indicators. Network-level blocking of the IP and domain is recommended for organizations to prevent residual exposure. The absence of additional details about the phishing kit or victim targeting leaves the exact scope of the campaign uncertain, though the investment-themed lure aligns with common financial fraud tactics.