finance35-ea52[.]pro

Analysis of finance35-ea52.pro indicates a newly registered credential‑phishing infrastructure. The domain was created on 17 June 2026 and is hosted behind Cloudflare, resolving to IP 104.21.63.195, which is geolocated to Canada and owned by Cloudflare, Inc. The site presents an HTTP 521 response and a page title of “404 Not Found”, suggesting that the malicious payload is not publicly visible at the root URL. TLS is provided by a Let’s Encrypt certificate (issuer E7), confirming the use of a free, automated certificate. Automated reconnaissance detected Cloudflare Browser Insights, Cloudflare and HTTP/3, confirming the front‑end protection layer. Reputation services rate the domain poorly: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on three public blocklists, currently blocked by PhishDestroy, MetaMask and SEAL. VirusTotal reports detections from 2 of 91 scanned vendors, reinforcing the malicious classification. The threat is labeled as generic credential phishing, indicating attempts to harvest user credentials, though the specific target brand or login portal has not been disclosed. Because the site remains active, defenders should add the domain to outbound‑filtering rules, monitor DNS queries for the host, and consider blocking the associated IP address. Continuous re‑scanning is advised to capture any changes in payload or additional vendor detections.