degofinanc[.]pro

Analysis as of July 22 2026 indicates that the domain degofinanc.pro is currently offline but continues to be listed on multiple security blocklists. The authoritative name servers are ns1.dns‑expired.com and ns2.dns‑expired.com, both associated with expired‑domain services, suggesting the registration was allowed to lapse before malicious use. No TLS certificate is presented, meaning the site served only HTTP, a common trait for low‑effort phishing deployments. The sole page title returned by the server is “degofinanc.pro”, providing no additional context about the targeted brand or campaign. The host resolves to the IPv4 address 198.18.0.201; this address has been observed in other threat feeds but no further attribution is available.

Three of ninety‑five VirusTotal scanners flagged the domain, confirming that at least a subset of commercial engines consider it malicious. Independent blocklists from PhishDestroy, ScamSniffer and Enkrypt have already added the domain, and the site appears on three additional public blocklists, reinforcing its reputation as a phishing resource. Reputation services assign a trust score of 1/100 on Scamadviser and 0/100 on Gridinsoft, reflecting an extremely low confidence rating. The combination of expired name servers, lack of encryption, low trust scores, and multiple vendor detections points to a deliberately crafted phishing infrastructure, likely aimed at credential harvesting.

What remains uncertain is the specific victim demographic, the exact phishing kit employed, and whether the IP address is shared with other malicious actors. Defenders should immediately add degofinanc.pro to domain‑based blocklists, deny outbound connections to 198.18.0.201 at the network perimeter, and ensure that any internal URLs matching the domain are quarantined. Continuous monitoring of the IP range and periodic re‑query of threat‑intel platforms is advised to capture any re‑activation attempts.