finance35-et34[.]pro

The domain finance35-et34.pro was registered through NameCheap, Inc. on April 16, 2026. Since registration, the domain has been observed resolving to the IPv4 address 172.67.205.217, a host that currently serves multiple unrelated sites and is frequently abused for malicious payload delivery. Independent threat‑intel feeds have placed the domain on three distinct security blocklists, and it is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering engines. A VirusTotal scan shows that four of ninety‑one participating security vendors have flagged the domain as malicious, reinforcing the suspicion that it is being used for phishing.

The threat classification attached to the domain is “generic phishing,” and the operational status is listed as active with an elevated risk rating. Analysis of the available evidence indicates that the domain is being leveraged as part of a phishing campaign, although the specific target brand, page title, or credential‑stealing kit has not been publicly disclosed. The limited detection count suggests that the malicious activity may be in an early stage or that the payload is evading broader detection. The presence on multiple blocklists and the fact that reputable anti‑phishing tools such as PhishDestroy and MetaMask have already blocked the domain provide a strong indication of hostile intent.

Defenders should continue to block traffic to finance35-et34.pro at the network perimeter, update DNS‑based blacklists with the observed IP 172.67.205.217, and monitor for any outbound connections to that address. Endpoint security solutions should be configured to treat the four VirusTotal detections as indicators of compromise, and security teams should consider adding the domain to internal phishing‑watch lists.