finance30-in96[.]pro

The domain finance30-in96.pro has been confirmed as a high-risk credential theft site. It does not appear to be associated with any specific brand or cryptocurrency but is actively used to steal user credentials. The site infrastructure and activity suggest a sophisticated phishing operation designed to capture sensitive information from unsuspecting users.

Technical analysis reveals that finance30-in96.pro has been flagged by 3 out of 95 security vendors on VirusTotal, indicating a moderate level of detection. The domain is registered through NameCheap, Inc., and resolves to the IP address 188.114.96.3. It was created on June 17, 2026. The SSL certificate is issued by Let's Encrypt, which is common among phishing sites due to its ease of acquisition. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further confirming its malicious nature.

As of the latest analysis, the domain remains active and accessible. Despite being blocked by several security solutions, it continues to pose a significant risk to users who may encounter it. Immediate actions include adding the domain to organizational blocklists and educating users on the signs of phishing. Ongoing monitoring is recommended to track any changes in the domain's activity and to ensure timely response to any new threats.