finance36-ut95[.]pro

This domain, finance36-ut95.pro, has been confirmed as an active crypto drainer phishing site designed to harvest wallet credentials and exfiltrate cryptocurrency assets. Analysis of the page title, which returns a 404 Not Found response, suggests the site may employ conditional redirection or cloaking techniques to evade detection during initial scans. While no explicit brand impersonation is currently visible, the domain naming convention (finance36-ut95) aligns with patterns observed in prior wallet-draining campaigns, where randomized alphanumeric strings are used to bypass reputation-based filters. Infrastructure analysis reveals the domain was registered on June 17, 2026, through NameCheap, Inc., a registrar frequently leveraged by threat actors due to its accessibility and bulk registration capabilities. The domain resolves to the IP address 188.114.97.3, which has been associated with other high-risk hosting environments. As of the latest assessment, the domain has not been flagged by VirusTotal, showing 0/95 detections, though it appears on three security blocklists. The SSL certificate is issued by Let's Encrypt (YE2), a common choice for phishing sites due to its free and automated issuance process. No entries were found in Google Safe Browsing at the time of analysis. Current status indicates the domain remains active and operational, with no takedown or sinkholing measures observed. The absence of detections in major scanning engines, combined with its presence on multiple blocklists, underscores the evolving tactics used to evade automated detection while maintaining operational persistence. Users are advised to treat this domain as high-risk and avoid interaction, particularly those in cryptocurrency-related activities. Network-level blocking of the IP 188.114.97.3 and monitoring for related subdomains or certificate reuse (Let's Encrypt YE2) is recommended for mitigation.