finance31-et89[.]pro

Analysis of finance31-et89.pro confirms it as an active credential-theft phishing domain, first registered on May 25, 2026, through NameCheap, Inc. As of July 29, 2026, the domain resolves to IP address 172.67.129.31 and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Four of ninety-one security vendors on VirusTotal detect the domain as malicious, indicating moderate but growing recognition of its threat status. Infrastructure review shows the domain remains operational and unobstructed by major browser-based protections, allowing continued exposure to potential victims. The registrar, NameCheap, is frequently used for low-cost, short-lived phishing domains due to its accessibility and privacy features.

No specific brand impersonation or phishing kit has been confirmed in available data, though the domain name suggests a financial or transactional theme. The exact content and target audience remain unanalysed; defenders should assume credential harvesting until further evidence emerges. Organisations should block the domain and its resolving IP at the network level.

Security teams are advised to monitor for connections to 172.67.129.31, particularly from endpoints with access to sensitive financial or corporate systems. Given the domain’s recent creation and active blocklist presence, it is likely part of a broader, evolving phishing campaign. Further investigation into related infrastructure is recommended to identify linked domains or IPs sharing the same hosting provider.