flugsvamp[.]fi

The domain flugsvamp.fi has been identified as a high-risk phishing threat, specifically a generic phishing site that targets users interested in darknet marketplaces. The page title 'Flugsvamp 4.0' suggests it impersonates the well-known Flugsvamp market, aiming to steal login credentials and potentially drain cryptocurrency wallets. This domain was created on May 27, 2026, and is currently active, posing an ongoing risk to unsuspecting visitors.

Technical analysis reveals that flugsvamp.fi resolves to IP address 172.67.214.56 and uses an SSL certificate issued by Let's Encrypt (E8). VirusTotal data shows that 2 out of 95 security vendors flag this domain as malicious, indicating some detection but also significant evasion. The domain appears on one security blocklist, and Google Safe Browsing status is not explicitly mentioned but should be considered potentially unsafe. The registrar information was not provided, but the recent creation date and active status are red flags.

Given the current status as still active, immediate action is recommended to block access to this domain at the network level and educate users about the phishing risk. While only two vendors detect it, the combination of a suspicious creation date, impersonation of a known brand, and the high-risk threat type warrants heightened vigilance. Users should avoid visiting flugsvamp.fi, never enter credentials or crypto information, and report any interactions to their security team. Continued monitoring for related domains is advised to mitigate the remaining risk.