finance37-et56[.]pro

This domain, finance37-et56.pro, was registered on April 15, 2026, through NameCheap, Inc., and is currently flagged as an active phishing threat targeting financial services. Infrastructure analysis reveals the domain resolves to IP address 104.21.89.186, which may be part of a content delivery network or shared hosting environment, a common tactic to obscure the origin of malicious activity. As of the report date, the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating detection by multiple independent threat intelligence sources. Detection data from VirusTotal shows that 4 out of 91 security vendors have flagged this domain, suggesting early but growing recognition of its malicious nature.

The low detection count may reflect either recent activation of the campaign or evasion techniques employed by the threat actors. No specific brand impersonation has been confirmed in the available data; the domain is classified as a generic phishing site targeting financial users. The exact content of the site remains unanalyzed, and no page title or phishing kit has been identified in the provided intelligence. Defenders should treat this domain as an elevated risk.

Network-level blocking of 104.21.89.186 and the domain itself is recommended for organizations in the financial sector or those handling sensitive user data. Monitoring for related domains registered through NameCheap with similar naming patterns (e.g., alphanumeric strings, finance-themed prefixes) may help identify additional threats from the same campaign. Given the domain's recent creation and active status, further detections are likely as more security vendors update their signatures. No Safe Browsing or OTX data was provided, so additional enrichment via those platforms is advised for a more comprehensive assessment.