fi-money[.]com

This domain, fi-money.com, is actively involved in a crypto drainer operation targeting users of financial platforms. Analysis indicates the site mimics legitimate cryptocurrency or banking interfaces to trick visitors into connecting wallets or entering sensitive credentials, enabling unauthorized fund transfers. The threat specifically focuses on draining digital assets from connected wallets, a tactic increasingly observed in targeted phishing campaigns against crypto users. Infrastructure analysis reveals the domain was registered on June 25, 2026, through GoDaddy.com, LLC, and currently resolves to the IP address 76.223.105.230. Despite its active status, the domain has not been flagged by security vendors, with a VirusTotal detection count of 0/95. The SSL certificate is also issued by GoDaddy.com, providing a false sense of legitimacy. No blocklist entries or prior malicious associations were identified at the time of this analysis, though the domain's future-dated registration raises additional suspicion. Users who have visited fi-money.com or interacted with its content should immediately disconnect any connected wallets and revoke permissions for associated smart contracts. Monitor transaction histories for unauthorized activity and consider replacing compromised wallet addresses. If credentials were entered, reset passwords for all linked accounts and enable multi-factor authentication where available. Given the domain's unverified status and lack of detections, users are advised to treat any communication or service claims from this domain as fraudulent.