finbridge[.]tw

PhishDestroy identifies finbridge.tw as an active fake financial portal phishing domain under investigation for credential harvesting. This domain mimics legitimate financial services to deceive users into entering sensitive account details, posing a significant risk to individuals and organizations handling financial transactions.

This domain, registered through GNAME.COM on May 01, 2026, resolves to IP 104.21.91.222 and leverages a Let's Encrypt SSL certificate to appear trustworthy. Despite zero detections on VirusTotal (1/95), the domain remains unlisted on major blocklists and lacks observable trust scores, indicating a newly emerged or stealthily operated threat. The absence of detections suggests this phishing infrastructure may still be flying under the radar of traditional security tools.

Mitigation requires immediate domain blocking at the network level and user awareness campaigns highlighting the risks of fake financial portals. Security teams should monitor for traffic to 104.21.91.222 and inspect SSL/TLS handshakes involving finbridge.tw for anomalies. Users should verify URLs before entering credentials and report suspicious financial login pages to their security teams. Given the domain's recent creation and SSL certification, heightened scrutiny is warranted to prevent credential compromise.