ryskfinanceapp[.]xyz

This domain, ryskfinanceapp.xyz, is actively engaged in credential theft operations targeting users of financial or cryptocurrency platforms. Analysis indicates the site mimics legitimate financial services to harvest login credentials, payment details, or other sensitive information. The infrastructure is designed to deceive users into entering personal data under false pretenses, which is then exfiltrated to attacker-controlled servers for malicious use, including account takeover or financial fraud.

Infrastructure analysis reveals the domain was registered on May 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, hosted behind CloudFlare in Canada, which is commonly used to obfuscate the true origin of malicious infrastructure. The domain is flagged by 3 out of 95 security vendors on VirusTotal, including detection as a phishing threat. Additionally, it appears on one security blocklist, further confirming its malicious nature. The SSL certificate, issued by Let's Encrypt, does not mitigate the risk, as it is routinely exploited by threat actors to lend false legitimacy to fraudulent sites.

Users who have visited ryskfinanceapp.xyz or entered credentials on the site should immediately take corrective action. Change passwords for any accounts accessed from the domain, enable multi-factor authentication where available, and monitor financial statements for unauthorized transactions. If payment details were submitted, contact the relevant financial institution to report potential fraud. Devices used to access the domain should be scanned for malware, and browser sessions should be cleared to remove any stored credentials or cookies associated with the site. Network-level blocking of the domain and its resolving IP (188.114.97.3) is recommended to prevent further exposure.