vss[.]finance

vss.finance is identified as an active generic phishing site with a high risk rating. The domain was registered on September 5, 2025 through Dynadot Inc and has been continuously serving malicious content since at least early 2026. The site presents a page titled "Web3 Connect Demo", a common lure used to harvest credentials for blockchain‑related services.

The authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net resolve the domain to IP address 172.67.208.109, which belongs to the Amazon.com, Inc. network (AS16509) and is fronted by Cloudflare, indicating use of a content delivery network and HTTP/3 support. The site is protected by a Let’s Encrypt short‑lived certificate, confirming recent TLS deployment. No additional infrastructure such as secondary hosting or command‑and‑control servers has been observed.

VirusTotal scans have flagged the domain with 5 detections out of 95 scanners, and the domain currently appears on the PhishDestroy and BLP‑Malware blocklists. An HTTP 301 redirect is observed, suggesting the site may serve multiple phishing pages or employ URL short‑ening techniques. The limited public view is restricted to the demo page; the specific credential‑capture forms, target brand pages, or payloads have not been publicly disclosed, leaving the exact phishing vector uncertain.

Defenders should immediately add vss.finance to URL filtering and sink‑hole rules, and enforce TLS inspection to capture any credential submissions. Continuous monitoring of the IP address and associated Cloudflare edge nodes is advised, as the threat actor may pivot to additional subdomains or reuse the same infrastructure for new campaigns. End‑user awareness training should emphasize the mismatch between legitimate Web3 connection interfaces and the generic "Web3 Connect Demo" page presented by this site.