finbridge[.]win

Analysis of finbridge.win confirms its classification as an active investment scam domain, registered on May 11, 2026, through Gname.com Pte. Ltd. The domain resolves to IP address 188.114.96.3, hosted on Cloudflare infrastructure (AS13335) in Canada, and uses Cloudflare nameservers (tessa.ns.cloudflare.com, ezra.ns.cloudflare.com). The page title, 'One-Stop Global Investment Platform | Forex | Commodities | Stocks | Indices | Cryptocurrencies | Gold | Oil,' explicitly advertises financial trading services, aligning with the reported scam type. As of July 12, 2026, the domain remains active with an HTTP 200 status, indicating operational hosting. SSL certification is provided by Let's Encrypt (serial number E8), a common but not exclusive indicator of legitimacy. Security vendor detection is limited, with 2 of 92 engines on VirusTotal flagging the domain, while three independent blocklists (PhishDestroy, MetaMask, SEAL) have already listed it. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. Defenders should treat finbridge.win as a confirmed threat vector for financial fraud. The domain's recent registration, use of Cloudflare for anonymization, and explicit investment-themed branding are consistent with known scam infrastructure. No evidence suggests compromise of legitimate services; this appears to be a standalone fraudulent platform. Network-level blocking is recommended, along with monitoring for associated IP or certificate reuse. Further analysis of the site's backend or user interactions is pending, but current indicators justify immediate containment.