finance1[.]expensenotifications[.]com

On July 29, 2026 the domain finance1.expensenotifications.com was identified as an active generic phishing infrastructure with an elevated risk rating. The domain resolves to the IPv4 address 13.210.89.195 and is listed on a single security blocklist. It is also actively blocked by the PhishDestroy mitigation service, indicating that at least one commercial anti‑phishing solution has incorporated the indicator into its protective ruleset.

VirusTotal analysis shows that 16 of 91 scanned security vendors have flagged the domain as malicious, providing independent corroboration of its malicious intent. The available intelligence does not include registrar details, SSL certificate information, HTTP response codes, or any page title metadata, leaving those aspects of the infrastructure unverified. Consequently, the precise hosting environment, certificate usage, and any potential content served by the site remain uncertain.

Defenders should prioritize immediate containment actions: add finance1.expensenotifications.com to network and DNS blocklists, enforce outbound filtering to the associated IP address 13.210.89.195, and ensure that endpoint security products are updated to reflect the 16 vendor detections reported by VirusTotal. Continuous monitoring for any new resolution changes or additional blocklist listings is advised, as further activity may expand the threat footprint.