euronews-help[.]biz

Analysis of euronews-help.biz indicates that the domain was registered on June 24, 2026 through Spaceship, Inc. and currently resolves to IP address 172.67.147.231, which is hosted by Cloudflare in Canada. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 designation, and it serves content over HTTP/3 using PHP on a Cloudflare edge network. The HTTP response code is 200, and the page title observed is "FinProConsult - Финансовая и юридическая помощь по всей Европе," suggesting a financial and legal assistance façade. Security telemetry shows that 11 of 91 VirusTotal scanners flag the domain, and it is listed on a single security blocklist. The domain is actively blocked by PhishDestroy and carries a Gridinsoft trust score of 0 out of 100, reinforcing its malicious classification as an investment scam. Defenders should immediately add euronews-help.biz to network and email filtering rules, monitor for any related CNAME or IP reuse, and consider broader threat‑intel sharing given the recent registration date. Further investigation is needed to determine the exact payload or credential‑harvesting mechanisms employed, as the site’s internal structure has not been publicly disclosed.