finance38-ad12[.]sbs

The domain finance38-ad12.sbs is currently flagged as an active generic phishing site specializing in brand impersonation. Infrastructure analysis shows the domain resolves to the Cloudflare‑owned address 188.114.96.3, which geo‑locates to Canada and is served through Cloudflare with HTTP/3 enabled. The site presents an HTTP 521 status code, indicating the origin server is unavailable, and the only visible page title returned is "404 Not Found." A Let's Encrypt certificate (E7) is in place, confirming TLS termination at the CDN edge.

The registrar is NameCheap, Inc., with the domain registration timestamp of June 17, 2026, indicating a very recent creation date. The Gridinsoft trust score is 0 out of 100, and the domain appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing its malicious classification. VirusTotal analysis reports five out of ninety‑one security vendors flagging the domain, providing additional corroboration of malicious intent.

While the available data confirms the domain’s use for brand‑impersonation phishing, the exact payload or credential‑harvesting mechanisms have not been publicly disclosed, and the content of the site beyond the 404 title remains unverified. Defenders should add finance38-ad12.sbs to network and email filtering blocklists, monitor DNS queries for this address, and enforce TLS inspection to capture any potential credential traffic. Continuous re‑scanning with multi‑vendor services is advised to capture any new malicious activity, and any inbound connections to the associated IP should be logged and investigated for signs of exploitation.