bracket[.]finance

The domain bracket.finance is identified as a high-risk generic phishing domain, currently active, impersonating a Web3 service. No specific brand impersonation has been confirmed, but the page title 'Web3 Connect Demo' suggests a potential target in the Web3 industry.

Analysis indicates that bracket.finance is registered through Dynadot Inc and resolves to the IP address 172.67.208.109, which is located in the United States and assigned to AS16509 Amazon.com, Inc. The domain was created on December 25, 2025, and is flagged by 4 out of 95 security vendors on VirusTotal. It appears on 1 known security blocklist and is specifically blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt under the YR2 certificate authority, which may lend a false sense of security to unsuspecting users.

The current status of bracket.finance is active, posing a significant threat to users who may be tricked into providing sensitive information. Recommendations include adding this domain to organizational blocklists, conducting regular security awareness training, and monitoring network traffic for any attempts to access this domain. Organizations are advised to verify the authenticity of any Web3 service connections and report any suspicious activities to their security teams.