finance36-et35[.]sbs

On 9 July 2026 (report date) the domain finance36-et35.sbs was observed actively used in a generic phishing campaign. The domain was registered through NameCheap, Inc. on 9 June 2026 and resolves to the IP address 188.114.97.3. VirusTotal scans show that six of ninety‑one security vendors have flagged the domain as malicious, indicating a moderate level of detection across the community. The domain is listed on three public security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL blocklist services, reinforcing its categorisation as a phishing infrastructure.

Analysis of the available telemetry does not reveal additional infrastructure such as associated sub‑domains, SSL certificate details, or HTTP response codes, so the full scope of the campaign remains uncertain. The relatively recent registration date combined with rapid detection suggests an opportunistic deployment rather than a long‑standing operation. Defenders should add finance36-et35.sbs to local deny lists, monitor DNS queries for the 188.114.97.3 address, and enforce URL filtering rules that reference the known blocklist entries.

Continuous re‑scanning on VirusTotal or similar platforms is advised to capture any changes in vendor detections. Organizations that rely on credential‑based authentication should educate users about unsolicited login prompts and encourage verification of URLs before credential entry. The active status of the domain warrants ongoing observation.