finance92-et85[.]sbs

The domain finance92-et85.sbs was created on 14 June 2026 and is currently active. Registration details show it was purchased through NameCheap, Inc., a registrar frequently used by malicious operators. DNS resolution points to the address 172.67.163.68, which is hosted on a shared infrastructure known to serve other suspicious sites.

The domain appears on three public security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple protective services have identified it as a phishing vector. VirusTotal analysis reports that 14 of 91 security vendors flag the domain as malicious, reinforcing the blocklist evidence. No additional data such as SSL certificate details, HTTP response codes, page titles, or brand targeting is available, leaving the exact phishing payload or lure unknown.

The lack of public content analysis means defenders cannot confirm the specific campaign tactics, but the combination of recent registration, known hosting provider, blocklist presence, and multiple vendor detections strongly suggests a high‑risk phishing operation. Organizations should add finance92-et85.sbs to their deny lists, monitor outbound traffic for connections to 172.67.163.68, and apply threat‑intel feeds that include the listed blocklists. Continuous re‑evaluation is advised in case further indicators, such as payload samples or phishing page snapshots, become available.