finance37-ut23[.]sbs

This domain, finance37-ut23.sbs, was registered on June 17 2026 through NameCheap, Inc. and resolves to the Cloudflare‑owned address 104.21.36.184 located in Canada. The site presents an HTTP 521 response and the only visible page title is “404 Not Found”. Cloudflare Browser Insights and HTTP/3 indicate the traffic is proxied via Cloudflare’s network. The domain is listed on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Reputation services assign a Gridinsoft trust score of 0 / 100, and ten of ninety‑one VirusTotal scanners have flagged the host, reinforcing its classification as a high‑risk crypto‑drainer phishing infrastructure. The SSL certificate is issued by Let’s Encrypt (E8). No additional content has been observed; the exact phishing landing page or payload remains unknown. Defenders should add finance37‑ut23.sbs to network‑level deny lists, enforce DNS sink‑holing, and ensure endpoint protection solutions are updated to recognize the associated blocklist entries. Continuous monitoring of traffic to the IP 104.21.36.184 and correlation with other Cloudflare‑hosted malicious domains is advised, as threat actors frequently reuse the same edge infrastructure for multiple campaigns.