rysk-finance[.]com

Analysis of the domain rysk-finance.com indicates it is actively engaged in phishing operations targeting users of AltLayer, a platform described as AI infrastructure for on-chain systems. The domain was registered on July 8, 2026, through Fewmoretaps OU, operating under the name Trustname.com, a registrar with a history of association with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 107.189.23.176, hosted under AS14956 (RouterHosting LLC) in the Netherlands. Nameservers are configured to a.dnspod.com, b.dnspod.com, and c.dnspod.com, a pattern commonly observed in domains linked to phishing campaigns. The SSL certificate is issued by Let's Encrypt (identifier YE1), a legitimate but frequently abused certificate authority due to its accessibility. The domain's trust score, as assessed by Gridinsoft, is 0/100, further supporting its classification as high-risk. Detection data from security vendors shows that 3 of 91 engines on VirusTotal flag the domain as malicious. Additionally, the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating widespread recognition of its malicious intent. The page title, 'AltLayer — AI Infrastructure for On-Chain Systems,' suggests an attempt to impersonate AltLayer's branding or services, though the exact content and functionality of the site remain unanalyzed. The domain's creation date, recent at the time of this report, aligns with typical phishing campaign timelines, where newly registered domains are rapidly deployed for malicious purposes. Defenders are advised to treat this domain as an active threat, block access at the network level, and monitor for related infrastructure or domains registered through the same registrar or hosting provider.