finance30-et40[.]pro

On 29 July 2026 the domain finance30-et40.pro was observed in multiple threat‑intel feeds. The domain was registered on 19 May 2026 through NameCheap, Inc., a registrar frequently used by malicious operators. The zone resolves to the IPv4 address 188.114.96.12, which is listed on three public security blocklists.

VirusTotal records show that four of ninety‑one scanning engines have flagged the domain, indicating that at least a subset of scanners identified malicious characteristics. Independent blocklist services PhishDestroy, MetaMask, and SEAL have also added the domain to their deny lists, reinforcing the assessment that the domain is being used for phishing‑related activity. No additional metadata such as SSL certificate details, HTTP response codes, or page titles are available in the current intelligence set, leaving the exact content and attack vector unconfirmed.

The combination of recent registration, use of a low‑cost registrar, presence on multiple blocklists, and partial detection by antivirus engines suggests an elevated risk profile. Defenders should proactively block traffic to finance30-et40.pro at perimeter firewalls and DNS filtering solutions, monitor outbound connections to the hosting IP 188.114.96.12, and consider adding the address to threat‑intel feeds used by intrusion‑detection systems. Ongoing collection of HTTP payloads and sandbox analysis is recommended to determine the specific phishing lure and any credential‑stealing modules that may be delivered.