finance99-at67[.]sbs

This domain, finance99-at67.sbs, is currently flagged as a high‑risk generic phishing resource. VirusTotal records show that eight out of ninety‑five scanning engines have identified malicious characteristics, and the Gridinsoft trust score is 0 out of 100, indicating a lack of confidence in its legitimacy. The site responds with HTTP status code 200 despite serving a page titled “404 Not Found,” a discrepancy often used to mask malicious intent while presenting a seemingly valid response to automated checks. The domain was registered on June 17, 2026 through NameCheap, Inc., and remains active as of the report date.

Infrastructure analysis reveals the domain resolves to IP address 188.114.97.3, which is part of Cloudflare’s network located in Canada. The host uses Cloudflare services, including Browser Insights and HTTP/3, and presents an SSL certificate issued by Google Trust Services under the WE1 designation. Such a combination of reputable CDN and encryption layers can obscure the true origin of the payload and complicate attribution. The domain appears on three public security blocklists, and multiple anti‑phishing engines have already blocked it, reinforcing the perception of abusive activity.

While the observable evidence confirms the domain’s malicious posture, the exact content delivered to victims remains uncertain because the page renders a “404 Not Found” title, preventing direct analysis of landing pages or credential‑stealing forms. Defenders should block any outbound or inbound traffic to finance99-at67.sbs, monitor DNS queries for the associated IP, and enforce strict email filtering rules to prevent users from receiving spoofed communications that reference the domain. Continuous re‑evaluation is advised, as the threat actor may modify the site’s payload or expand its infrastructure in the near term.