finance39-ad7[.]pro

The domain finance39-ad7.pro was registered on June 17, 2026 through NameCheap and currently resolves to the Cloudflare‑hosted address 104.21.20.223 located in Canada. The site presents an SSL certificate issued by Let’s Encrypt (E8) and uses Cloudflare services including Browser Insights and HTTP/3. HTTP probing returns status code 521, indicating the origin server is unavailable, and the only observable page title is "404 Not Found." VirusTotal records two detections out of ninety‑one scanners, and Gridinsoft assigns a trust score of 0 / 100, reflecting a high likelihood of malicious activity. The domain is classified as a "Crypto Drainer" scam and appears on three public blocklists, with active blocks enforced by PhishDestroy, MetaMask, and SEAL. While the exact payload or phishing page content cannot be verified due to the unavailable origin server, the combination of low trust rating, detection alerts, and blocklist presence suggests the domain is being used to lure cryptocurrency users into transferring funds to attacker‑controlled wallets. Defenders should immediately block finance39-ad7.pro at DNS and proxy layers, incorporate the domain into URL filtering rules, and monitor for any subsequent sub‑domains or similarly patterned registrations. Continuous threat‑intel feeds should be consulted for emerging indicators related to crypto‑draining campaigns, and any network traffic to the associated Cloudflare IP should be scrutinized for anomalous behavior.