Evofince: Fake Licenses, Template Infrastructure, and a Phantom Crypto Exchange

Report

Executive Summary

An investigation into the cryptocurrency platform evofince[.]com has uncovered several significant contradictions regarding its history, legal standing, and technical infrastructure. Although the platform presents itself as a well-established exchange with a massive user base and high trading volume, official records show the domain was only registered in January 2026. Technical analysis revealed "leaks" in the site’s directory structure and shared digital fingerprints that suggest a relationship with an external framework known as Fury Panel. Furthermore, multiple claims of government regulation could not be verified through official channels. Taken together, these findings suggest that the platform may be designed to mimic legitimate financial services to attract user deposits while operating without verified oversight.

Scam Type Analysis

The platform exhibits characteristics typically associated with Fake Cryptocurrency Exchanges, often used for liquidity or exit-style fraud. The methodology appears to rely on three main pillars:

The "Trust Facade": The site utilizes a sophisticated user interface to project an image of a high-fidelity, high-volume exchange. This is likely intended to lower the guard of victims who may be targeted through social engineering, such as "Pig Butchering" schemes or misleading social media advertisements.

Fabricated Authority: By listing unverified licenses and non-existent partnerships with major media outlets like Forbes and Bloomberg, the platform creates a "safe" environment to encourage users to make large-scale deposits.

Technical Obfuscation: The infrastructure uses services like Cloudflare to hide its actual hosting location and appears to utilize standardized templates. This allows for the rapid deployment of new domains if the current one is flagged or shut down.

Evidence Analysis

The investigation followed a narrative of discovery, where one inconsistency led to the next, painting a picture of a platform that may not be what it claims to be.

The Conflict of Time The most glaring discrepancy is the "Time Paradox." Evofince’s "Regulation" page cites licenses issued as far back as 2021, and its Terms of Service claim to have been updated in late 2024. However, a Whois lookup confirms the domain evofince[.]com was not registered until January 10, 2026. It is logically inconsistent for a platform to have legal updates and regulatory history that predates the creation of its own website by several years.

The Regulation Gap To verify the platform's claims of being "fully regulated," searches were conducted within the official databases of FinCEN (USA), the MFSA (Malta), and the MAS (Singapore). No record of "Evofince" was found in any of these registries. This suggests that the regulatory credentials displayed on the site are self-attributed rather than legally verified.

Infrastructure "Leaks" and Fingerprints A deep dive into the site’s file structure revealed that navigating to the /images/coins directory triggers an automatic redirect to furypanel[.]com. This technical behavior indicates a direct link between Evofince and the Fury Panel domain, suggesting they share the same backend infrastructure or website template.

To further investigate this link, the SSL certificates for both domains were analyzed. Each certificate has a unique SHA-256 fingerprint and Public Key. Because both sites share similar technical configurations, these "digital serial numbers" suggest the domains are managed within the same centralized framework.

Surface-Level Development While the homepage looks professional, the underlying functionality appears rushed. For instance, the FAQ section displays questions but lacks functional dropdowns to show the answers. Additionally, most navigation buttons simply redirect back to a generic login prompt. Within the source code, internal comments were found written in Russian, providing a data point regarding the likely language or origin of the development team responsible for the template.

Ioc Section

The following indicators are defanged to prevent accidental navigation:

Primary Domain: hxxps[://]evofince[.]com

Infrastructure Link: hxxps[://]furypanel[.]com

Observed Redirect Path: hxxp[://]evofince[.]com/images/coins

Digital Fingerprints (Certificates) | Entity | SHA-256 Fingerprint | Public Key |

| Evofince | 3d0dc389ba35dfb841db343d41fb2f01aec0f71e227473e3e178d57d78351b85 | 013c7280e377fc9cf1b9521c8c74345da28f17aa46f3c187eb8003773629a6d8 | | Fury Panel | 49942de878a50c1ef57377224c9b9dbb9cbcca1df44880ea90fdb8a215a2fac6 | d03551c945086f881105d4f113e0a28ce67b93a567f5bf32e1cdb8e80f850174 | Administrative Artifacts

Registrar: Realtime Register B.V.

Registration Date: 2026-01-10

Hosting/Proxy: Cloudflare Inc.

Recommendations

Administrative Takedown Actions

Registrar Report: Submit the observed chronological discrepancies and unverified regulatory claims to abuse[@]realtimeregister.com for internal review.

Cloudflare Report: File a "Phishing/Fraud" report at cloudflare.com/abuse to request that a browser warning be placed on the domain.

User Protection and Reporting

Official Reporting: Users who have interacted with or deposited funds into the platform should file a report with the FBI’s Internet Crime Complaint Center (ic3.gov) or their local fraud authority.

Community Awareness: Documenting these evidence-based observations on platforms like Trustpilot and Reddit will help other users perform their own due diligence.

Recovery Scams: Users should be cautioned that "Crypto Recovery" experts who contact them on social media are almost always secondary fraudulent schemes.

Findings

Observed Infrastructure Links (high)

Analysis of the website’s directory structure revealed that specific paths, such as /images/coins/, automatically redirect the user to an external domain, furypanel[.]com. This technical behavior suggests that the platform may not be an independent development but instead utilizes a shared infrastructure or a third-party template. Such redirections are often observed in standardized website kits where the backend assets remain hosted on a central server.

Chronological Discrepancies (high)

The platform’s documentation, including its "Regulation" page and "Terms of Service," contains claims of operational history and legal updates dating back to 2021 and 2024. However, public registry records indicate the domain was created on January 10, 2026. This creates a significant discrepancy between the platform’s stated history and its verifiable technical existence.

Unverified Regulatory Claims (high)

The platform references registration and oversight by several financial authorities, including FinCEN (USA), the MFSA (Malta), and MAS (Singapore). A search of the public databases for these respective regulators yielded no matching records for "Evofince" at the time of this investigation. The inability to verify these credentials suggests the regulatory information provided on the site may be inaccurate.

Observed Functional Limitations (medium)

Several interactive elements of the website appear to be non-functional. For instance, the FAQ section provides questions without accessible answers, and multiple navigation links redirect the user back to the login interface rather than the intended content pages. These observations are consistent with a "facade" style deployment, where the user interface is visually complete but lacks the underlying functionality of a standard financial exchange.

Technical Fingerprints (SSL Analysis) (medium)

Technical analysis of the SSL/TLS certificates for both evofince[.]com and furypanel[.]com identifies unique SHA-256 fingerprints and Public Keys. These digital signatures indicate a technical relationship between the two domains. Tracking these specific identifiers allows for the identification of other platforms that may be utilizing the same security configuration and infrastructure.

Developer Language Artifacts (info)

The underlying source code of the platform contains internal developer comments written in Russian. While this does not indicate the nature of the site's intent, it provides a technical data point regarding the likely origin or language of the development team responsible for the site's code.

Evidence reviewed

Evofince Reddit

On reddit it stated that Evofince was a crypto scam site that doesn't allow you to withdraw funds. https://www.reddit.com/r/Crypto_Scam_Exchange/comments/1qpmyua/new_scam_exchange_evofincecom/

Source: Reddit.

Whois lookup: Evofince

Whois Lookup of Evofince https://www.whois.com/whois/evofince[.]com

Source: Whois.com.

Whois lookup: Furypanel pt1

Whois lookup of Furypanel.com part 1

Source: Whois.com.

Whois lookup: Furypanel pt 2

Whois lookup of Furypanel.com part 2

Source: Whois.com.

NO MFSA License

Evofince claims to have a license under MFSA but when searching for them, no results are shown. Which means they lied about being registered under MFSA: https://www.mfsa.mt/financial-services-register/

Source: https://www.mfsa.mt/financial-services-register/.

No MAS License

No record of Evofince on Monetary Authority of Singapore(MAS), which Evofince claimed they were registered under: https://eservices.mas.gov.sg/fid/institution?term=evofince

Source: https://eservices.mas.gov.sg/fid/institution?term=evofince.

Evofince to FuryPanel URL Leak

Going to http://evofince[.]com/images/coins takes you to https://furypanel[.]com/images/coins/ meaning that Furypanel might be Evofince's backend.

Source: https://furypanel[.]com/images/coins/.

No Fincen registration

claimed to be registered under Fincen.gov, not registered

Source: https://www.fincen.gov/resources/msb-state-selector.

Evofince Website

Evofince's website

Source: https://evofince[.]com/.

Evofince Certificate

Evofince[.]com SHA-256 Certificate Fingerprint: 3d0dc389ba35dfb841db343d41fb2f01aec0f71e227473e3e178d57d78351b85

Public Key: 013c7280e377fc9cf1b9521c8c74345da28f17aa46f3c187eb8003773629a6d8

Source: evofince[.]com.

Furypanel Certificate

Furypanel.com

SHA-256 Certificate Fingerprint: 49942de878a50c1ef57377224c9b9dbb9cbcca1df44880ea90fdb8a215a2fac6

Public Key: d03551c945086f881105d4f113e0a28ce67b93a567f5bf32e1cdb8e80f850174

Source: furypanel[.]com.

Indicators observed

| Type | Value | Status | | --- | --- | --- | | hash | 013c7280e377fc9cf1b9521c8c74345da28f17aa46f3c187eb8003773629a6d8 | Confirmed | | url | hxxps://furypanel[.]com/images/coins/ | Confirmed | | hash | d03551c945086f881105d4f113e0a28ce67b93a567f5bf32e1cdb8e80f850174 | Confirmed | | url | hxxp://evofince[.]com/images/coins | Confirmed | | hash | 3d0dc389ba35dfb841db343d41fb2f01aec0f71e227473e3e178d57d78351b85 | Confirmed | | domain | evofince[.]com | Confirmed | | domain | furypanel[.]com | Confirmed | | hash | 49942de878a50c1ef57377224c9b9dbb9cbcca1df44880ea90fdb8a215a2fac6 | Confirmed |

Publication note

This entry was migrated from CSRF's legacy ThreatRecord publication. The evidence and assessment remain subject to the limitations described in the report.