finance30-ut22[.]pro

The domain finance30-ut22.pro is currently active and engaged in brand impersonation targeting MetaMask, a widely used cryptocurrency wallet service. This infrastructure is designed to deceive users into interacting with fraudulent interfaces, potentially leading to unauthorized access or asset compromise. Analysis indicates the domain is not a generic phishing attempt but a targeted effort to exploit trust in the MetaMask brand. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on June 17, 2026, and resolves to the IP address 172.67.144.132. It is flagged by 2 of 95 security vendors on VirusTotal, while appearing on three distinct security blocklists. The SSL certificate is issued by Let's Encrypt (serial number E8), a common tactic to lend superficial legitimacy. The page title, '404 Not Found,' suggests either a placeholder state or an attempt to evade detection by presenting as inactive while remaining operational. Current status confirms the domain remains active, posing a continued risk to users. Organizations and individuals are advised to block the domain and associated IP at the network level. Users should verify all interactions with MetaMask exclusively through official channels, including the verified browser extension or mobile application. Security teams should monitor for additional domains registered under the same infrastructure or following similar naming patterns, as this may indicate an ongoing campaign.