finance31-ea13[.]sbs

The domain finance31-ea13.sbs, once active, targeted MetaMask users through phishing tactics. Although currently offline, it was flagged by 9 out of 91 VirusTotal vendors, indicating its malicious nature. This domain was also listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, underscoring its threat level.

Registered through NameCheap, Inc., finance31-ea13.sbs was hosted on the IP address 104.21.33.166. The SSL certificate was issued by Let's Encrypt, a common choice for phishing domains due to its free and automated nature. The domain's page title, "404 Not Found," suggests it has been taken down, but it previously posed a significant risk to MetaMask users.

Phishing domains like finance31-ea13.sbs exploit the time gap between registration and detection by antivirus vendors, often remaining active long enough to deceive users. PhishDestroy's early detection and inclusion in public blocklists help mitigate such threats. Despite its current offline status, the domain's history serves as a reminder of the persistent risks associated with phishing attacks.