finance37-ut84[.]pro

This domain, finance37-ut84.pro, is flagged as a generic phishing site designed to harvest user credentials through a fake login portal. Analysis indicates the domain remains active and operational, with no legitimate content observed during initial scans. The threat type is classified as a credential theft attempt, though no specific brand impersonation has been confirmed at this time. Infrastructure analysis reveals the domain was registered on June 17, 2026, through NameCheap, Inc. and currently resolves to the IP address 172.67.131.192. Despite its recent creation, the domain has been added to three security blocklists, including entries from PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let's Encrypt (identifier: YE1), and the page title consistently returns a 404 Not Found error, which may indicate cloaking behavior or an incomplete deployment. VirusTotal reports zero detections out of 95 vendors, suggesting the domain has not yet been widely flagged by automated detection systems. The current status of finance37-ut84.pro remains active, posing a high risk to users who may encounter it through phishing campaigns or malicious redirects. Organizations are advised to block the domain and its associated IP address at the perimeter level. Endpoint protection systems should be updated to include this domain in real-time blacklists, and users should be educated to recognize generic phishing attempts, particularly those mimicking login portals. Network traffic logs should be reviewed for any connections to 172.67.131.192 or related subdomains, with particular attention to outbound requests originating from internal systems.