finance99-et79[.]sbs

Finance99-et79.sbs is currently classified as a generic phishing site with an elevated risk rating. The domain was registered through NameCheap, Inc. on June 07 2026 and resolves to the IPv4 address 188.114.96.3. Reputation data shows the domain is listed on three public security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services. VirusTotal analysis indicates that six of ninety‑one AV engines have flagged the domain as malicious, confirming a non‑trivial detection rate.

No additional metadata such as TLS certificate details, HTTP response codes, or page titles has been disclosed, leaving the content of the hosted site unverified. The limited visibility on the underlying web content introduces uncertainty about the exact phishing lure employed, but the consistent labeling across blocklists and the multi‑vendor detections suggest an operational phishing infrastructure. The elevated risk rating reflects the combination of early domain age, hosting on a single IP address, and presence on multiple blocklists, which together increase the likelihood of active credential harvesting. Defenders should add finance99-et79.sbs to network‑level deny lists, enforce DNS sink‑hole routing for the associated IP address, and monitor outbound connections to 188.114.96.3 for anomalous traffic.

Security teams should also consider isolating any credential submission traffic to this domain and applying heuristic detection for similar domain patterns that share the finance99‑et79 prefix. Continuous re‑scanning on VirusTotal and correlation with emerging blocklist entries are recommended to capture any changes in the domain’s behavior. Organizations using the blocked services (PhishDestroy, MetaMask, SEAL) can rely on their existing blocks, but independent security stacks should replicate the same deny rule to mitigate exposure. Given the recent creation date, the domain may evolve rapidly; therefore, periodic intelligence refreshes are advised.