finance31-at96[.]pro

This domain, finance31-at96.pro, is confirmed to host a crypto drainer phishing operation targeting cryptocurrency wallet users. Analysis indicates the site is designed to trick victims into connecting their wallets, enabling malicious smart contracts to execute unauthorized transactions and drain funds. The threat actor employs social engineering tactics, such as fake token airdrops or investment opportunities, to lure users into interacting with the malicious interface. The domain’s infrastructure and rapid deployment suggest a coordinated campaign aimed at exploiting users of decentralized finance (DeFi) platforms. Evidence supporting this assessment includes detection by 3 out of 95 security vendors on VirusTotal, registration through NameCheap, Inc. on June 17, 2026, and presence on three security blocklists. The domain resolves to the IP address 188.114.97.3 and uses a Let’s Encrypt SSL certificate (YE1), a common tactic to appear legitimate. Despite displaying a 404 Not Found error, historical analysis and blocklist data confirm its active use in phishing campaigns. The domain is currently blocked by multiple security frameworks, including PhishDestroy, MetaMask, and SEAL, further validating its malicious intent. Users who have visited finance31-at96.pro or interacted with its content should immediately disconnect any connected wallets and revoke permissions for suspicious smart contracts. It is critical to check wallet transaction histories for unauthorized activity and transfer remaining assets to a new, secure wallet. Additionally, affected users should monitor their systems for malware or unauthorized access, as phishing sites often deploy secondary payloads. If credentials or private keys were entered, assume compromise and take immediate action to secure all associated accounts. Organizations should update their security policies to block this domain and its associated IP address to prevent further exposure.