finance99-et54[.]sbs

Finance99-et54.sbs was registered on June 03, 2026 through NameCheap, Inc. The domain resolves to the IP address 172.67.179.107, which is hosted on a Cloudflare edge network. Within three days of its creation the domain was added to three independent security blocklists and is currently listed by PhishDestroy, MetaMask, and SEAL as a malicious site. VirusTotal has processed the domain and six of ninety‑one scanned scanners returned a malicious verdict, confirming the presence of phishing‑related indicators.

The rapid appearance on multiple blocklists and the early detection by reputable anti‑phishing services suggest the site is being used for credential‑stealing campaigns targeting financial services. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or content analysis is available at this time, leaving the exact phishing vector and victim profile unconfirmed. Defenders should block any traffic to finance99‑et54.sbs at the network perimeter, update URL filtering lists with the observed blocklist entries, and monitor for related C2 infrastructure tied to the hosted IP.

Continuous re‑scanning of the domain on VirusTotal and other sandbox services is advised to capture any evolving payloads or changes in hosting. Organizations that rely on financial credential authentication should enforce multi‑factor authentication and educate users about unsolicited requests for login information, especially from newly created domains such as this one.