finance33-at79[.]sbs

This domain, finance33-at79.sbs, is actively associated with a generic phishing campaign targeting cryptocurrency users. Analysis indicates it likely functions as a fake crypto wallet interface or credential harvester, designed to drain digital assets or capture login credentials. The domain mimics legitimate wallet services, leveraging social engineering tactics to deceive users into entering sensitive information such as private keys or recovery phrases. Despite currently displaying a 404 error, the infrastructure remains operational and may serve malicious content dynamically or redirect users to active phishing pages under different paths or subdomains. Evidence supporting this assessment includes detection by 13 out of 95 security vendors on VirusTotal, with the domain appearing on three distinct security blocklists. Infrastructure analysis reveals it was registered through NameCheap, Inc. on June 17, 2026, an unusually future-dated creation that may indicate an attempt to evade reputation-based filtering. The domain resolves to IP address 104.21.96.25 and uses a Let's Encrypt SSL certificate (serial number E8), providing a false sense of security. Additional intelligence confirms blocking by multiple independent threat feeds, further validating its malicious classification. Users who have visited finance33-at79.sbs should immediately cease all interaction and assume compromise of any credentials entered. If cryptocurrency wallet details were provided, transfer assets to a new wallet with a fresh seed phrase and monitor all connected accounts for unauthorized transactions. Clear browser caches and scan local devices for malware using updated security tools. Report the domain to relevant financial platforms and consider revoking access to any connected decentralized applications. Network administrators should block the domain and its resolving IP at the perimeter to prevent further exposure.