finance36-ut1[.]pro

Analysis of finance36-ut1.pro shows a high‑risk, active crypto‑drainer operation. The domain, registered through NameCheap on 17 June 2026, resolves to IP 104.21.9.19, a Cloudflare address located in California. Cloudflare services are evident, with Browser Insights, HTTP/3, and a Let's Encrypt E7 certificate present, but the site returns a 404 Not Found page and an HTTP 521 status, indicating a Cloudflare‑generated error page rather than legitimate content. The domain appears on three security blocklists and has been blocked by multiple threat‑intelligence feeds, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. VirusTotal reports that 2 of 91 scanning engines flag the domain, suggesting some detection of malicious activity. The specific scam type is identified as a crypto drainer, targeting cryptocurrency wallets or transactions. While the exact phishing payload or landing page has not been captured, the combination of blocklist presence, low trust score, and classification as a crypto drainer provides concrete evidence of malicious intent. Defenders should continue to block finance36-ut1.pro at network and endpoint layers, monitor for any related IP activity, and ensure that security policies are updated to include this indicator of compromise. Ongoing surveillance is recommended to detect any changes in hosting or content that could affect mitigation strategies.