finance35-ea14[.]sbs

This domain, finance35-ea14.sbs, is assessed at a high risk level with a specific threat type of credential theft. The domain is actively being used to harvest login credentials and personal information from unsuspecting users, posing a significant threat to financial and personal data security.

Analysis indicates that 8 out of 95 security vendors on VirusTotal flag this domain as malicious. The domain is registered through NameCheap, Inc., and resolves to the IP address 104.21.56.136. It was created on June 17, 2026, and currently appears on 3 security blocklists, including PhishDestroy and SEAL. The SSL certificate is issued by Let's Encrypt, which is a common choice for phishing sites due to its ease of use and low cost. The page title '404 Not Found' suggests that the threat actors may be using dynamic content or intentionally obfuscating the site to avoid detection.

To mitigate the risks associated with credential theft, it is recommended that users avoid interacting with this domain and report it to their respective security teams. Organizations should update their firewalls and security configurations to block traffic to this IP and domain. Additionally, implementing multi-factor authentication (MFA) for all online accounts can significantly reduce the impact of stolen credentials. Regularly monitoring and auditing access logs can help identify any unauthorized access attempts resulting from this threat.