finovatelearn[.]com

On 19 July 2026 the domain finovatelearn.com is observed hosting a malicious page with the title “Crypto Premium”. The site resolves to the IPv4 address 45.131.214.246, which is geolocated to Germany and is operated by MHost LLC. Registration records show the domain was created through NICENIC INTERNATIONAL GROUP CO., LIMITED and is served by the authoritative name servers ns3.my-ndns.com and ns4.my-ndns.com. HTTP requests return status code 200 and the TLS certificate is issued by Let’s Encrypt (YR2). Threat intelligence indicates the domain appears in twelve AlienVault OTX pulses and is listed on one public blocklist; it is actively blocked by the PhishDestroy feed. VirusTotal analysis shows five of ninety‑one scanners flag the domain as malicious, confirming a consensus of suspicious behavior. The evidence points to a high‑risk generic phishing campaign targeting users interested in cryptocurrency services. While the exact content of the landing page has not been examined, the presence of a “Crypto Premium” title and the consistent detection across multiple feeds suggest credential‑stealing or financial fraud intent. Defenders should block DNS resolution to 45.131.214.246, add finovatelearn.com to web‑filtering and email‑security blocklists, and monitor for related indicators such as the listed name servers and the Let’s Encrypt certificate fingerprint. Ongoing observation is recommended to detect any changes in hosting or content.