finance32-et72[.]pro

The domain finance32-et72.pro was registered through NameCheap, Inc. on May 14, 2026. Since its creation, the domain has been observed on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple protection services have identified it as malicious. VirusTotal analysis shows that four out of ninety‑one scanning engines flagged the domain, confirming a consensus of at least limited detection across the security community. The domain resolves to the IPv6 address 2a06:98c1:3121::3, which can be used to locate the hosting infrastructure for network‑level mitigation.

No additional data on SSL certificates, HTTP response codes, page titles, or content have been published, so the exact nature of the hosted content remains unknown beyond the generic phishing classification supplied. The lack of publicly available page metadata limits attribution of the specific phishing lure, but the presence on multiple blocklists and the VirusTotal detections suggest an operational campaign targeting users who may be lured by financial‑related messaging. Defenders should add finance32-et72.pro to DNS and endpoint blocklists, enforce outbound filtering for the IPv6 host, and monitor network logs for connections to the address 2a06:98c1:3121::3.

Because the registrar is NameCheap, investigators may consider requesting WHOIS or registrar‑level data to aid attribution. Continuous re‑scanning of the domain on VirusTotal and similar platforms is recommended to capture any changes in detection status. Until further intelligence is released, the domain should be treated as high‑confidence malicious and blocked across email gateways, web proxies, and security appliances.