xn--ulr-qddc[.]xn--finncpphbrswappools-sopccc7ivk2v88lha3023rdaje[.]fi-s1[.]co[.]com

The domain xn--ulr-qddc.xn--finncpphbrswappools-sopccc7ivk2v88lha3023rdaje.fi-s1.co.com is a confirmed generic phishing site targeting cryptocurrency users. It poses an elevated risk as a cryptocurrency scam, designed to deceive victims into disclosing sensitive information or transferring digital assets. No specific brand or drainer kit was identified in association with this domain. As of the latest verification, the site has been taken offline.

Technical indicators confirm the domain's malicious nature. Only 1 of 95 VirusTotal security vendors flagged xn--ulr-qddc.xn--finncpphbrswappools-sopccc7ivk2v88lha3023rdaje.fi-s1.co.com, specifically Gridinsoft, with a trust score of 0/100. The domain appears on 1 security blocklist, PhishDestroy. It was created on February 21, 2026, and resolves to the IPv6 address 2606:4700:20::ac43:474a, hosted by Cloudflare, Inc. in the US (AS13335). The SSL certificate is issued by E6, and the observed page title matches the domain name exactly.

Users who interacted with xn--ulr-qddc.xn--finncpphbrswappools-sopccc7ivk2v88lha3023rdaje.fi-s1.co.com should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new, secure wallet. Enable two-factor authentication on all accounts and monitor for unauthorized transactions. Report the domain to relevant platforms, including Google Safe Browsing, PhishTank, and local cybersecurity authorities, to prevent further exploitation.