finance-us[.]xyz

This domain, finance-us.xyz, is actively engaged in credential theft operations. Analysis indicates the site presents a fraudulent "Service Status" page designed to deceive users into submitting login credentials, likely for financial or corporate accounts. The domain remains operational as of the latest verification, posing an ongoing risk to unsuspecting visitors. Infrastructure analysis reveals the domain was registered on June 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 104.21.72.98 and has been flagged by 4 of 95 security vendors on VirusTotal. The domain appears on one security blocklist, and AlienVault OTX records it in a single threat intelligence pulse. The creation date suggests recent deployment, aligning with typical phishing campaign timelines. Current status confirms the domain is still active, with no indications of takedown or mitigation. Organizations and users are advised to block the domain and associated IP address at the network level. Security teams should monitor for related indicators, including the registrar and hosting infrastructure, to prevent further exploitation. End-users should be educated on recognizing credential theft tactics, particularly those involving fake service status or login pages.