Spoofed FINRA Domain Name

Summary

The US Financial Industry Regulatory Authority (FINRA) issued a warning detailing the malicious use of the finnra[.]org domain to impersonate the authority by using an extra "n' in the domain name. The registration form on the spoofed site, if completed and submitted, collects sensitive information and could potentially be used in phishing attacks. The IP address hosting the spoofed domain also hosts other domains, whose legitimacy is unknown. At the time of this writing, the finnra[.]org domain is no longer accessible.

Recommendations

The NJCCIC recommends users and organizations educate themselves and others on these continuing threats and tactics to reduce victimization. Users are advised to navigate directly to authentic vendor websites, keep applications up to date, and enable multi-factor authentication where available. More information can be found in the FINRA notice and Bleeping Computer article.