finance35-ut23[.]pro

This domain is flagged as a credential harvesting phishing endpoint targeting financial service users. Analysis indicates the infrastructure is designed to mimic legitimate banking or cryptocurrency platforms, likely deploying fake login portals to capture user credentials, session tokens, or financial transaction details. The domain exhibits characteristics consistent with automated phishing kits, including rapid deployment cycles and disposable hosting patterns commonly observed in high-volume credential theft operations. Infrastructure analysis reveals the domain finance35-ut23.pro was registered on June 17, 2026, through NameCheap, Inc., a registrar frequently utilized for short-lived phishing campaigns. The domain resolves to IP address 188.114.97.3 and is currently active despite returning a 404 Not Found page title, suggesting the phishing content may be selectively served or temporarily disabled. It appears on three security blocklists and is preemptively blocked by multiple threat intelligence feeds, yet remains undetected by all 95 engines on VirusTotal as of the latest scan. The SSL certificate is issued by Let's Encrypt with serial number YE2, a common choice for malicious actors due to its free and automated issuance process. Users who accessed finance35-ut23.pro should immediately revoke any active sessions associated with financial accounts, rotate all credentials entered on the site, and enable multi-factor authentication where available. Network administrators are advised to block traffic to 188.114.97.3 and monitor for connections to the domain across all endpoints. If browser interactions occurred, clear cached data and inspect systems for unauthorized modifications or installed browser extensions. Given the domain's high-risk classification and active status, any engagement with this infrastructure should be treated as a potential compromise requiring immediate containment and forensic review.