onlinefinancesbank[.]xyz

The domain onlinefinancesbank.xyz was registered on September 18, 2024 through OwnRegistrar, Inc. and is presently taken offline. Infrastructure analysis shows the domain resolves to the IP address 192.3.190.186, which belongs to AS36352 operated by HostPapa in the United States. The hosting provider does not present an SSL certificate for the site, indicating that any traffic would be transmitted without encryption. The page title returned from the HTTP endpoint is "Welcome to | Online Finances Bank," which aligns with the declared scam type of Banking Phishing.

The domain is listed on one security blocklist and has been actively blocked by PhishDestroy. Reputation scoring from Gridinsoft assigns a score of 0 out of 100, reflecting a complete lack of trust. VirusTotal analysis reports that 7 of 95 scanning engines flagged the domain, confirming malicious intent despite the relatively low detection count. Nameserver records point to dns1.webproserver.com and dns2.webproserver.com, with a null entry indicating a possible misconfiguration.

The threat actor explicitly impersonates Google, targeting users who may be lured by the financial-sounding brand name. Defenders should add the IP address 192.3.190.186 to network blocklists, monitor DNS queries for the associated nameservers, and ensure that any outbound connections to this domain are denied. Given the absence of TLS, any attempted connections would be vulnerable to interception, but the primary mitigation is to prevent access entirely. Continuous monitoring of blocklist updates and VirusTotal re‑scans is advised to capture any changes in the domain's activity or detection profile.