el-finances[.]online

This domain, el-finances.online, is currently flagged as an active credential harvesting phishing site targeting financial or corporate users. Analysis indicates the site is designed to mimic legitimate document-sharing or financial portals, as suggested by its generic page title 'Document,' a common tactic to deceive users into submitting sensitive login credentials or personal information. The domain remains operational and poses a high risk to individuals and organizations unaware of its fraudulent nature. Infrastructure analysis reveals the domain was registered on June 17, 2024, through Spaceship, Inc., a registrar frequently associated with newly created phishing domains. It resolves to the IP address 150.241.82.7, which has been linked to other suspicious activities in recent threat intelligence reports. The domain is secured with a Let's Encrypt SSL certificate, a tactic often employed by threat actors to create a false sense of legitimacy. Detection metrics further confirm its malicious intent, with 12 out of 95 security vendors on VirusTotal flagging the domain as malicious. No reputable blocklists or trust scores currently list the domain as benign, reinforcing its classification as a high-risk threat. As of the latest assessment, el-finances.online remains active and continues to host phishing content. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to include the IP address 150.241.82.7. Users who may have interacted with the site should immediately reset any credentials entered and monitor accounts for unauthorized activity. Security teams are encouraged to review logs for connections to the domain or IP and correlate them with potential compromise indicators. Proactive measures, such as employee awareness training and multi-factor authentication enforcement, are recommended to mitigate the risk of credential harvesting attacks.