finance39-et65[.]pro

On July 29, 2026, analysis of the domain finance39-et65.pro indicates that it is actively employed in a generic phishing campaign and is classified with an elevated risk level. The domain was registered on May 11, 2026 through NameCheap, Inc., and its DNS resolution points to the IP address 172.67.191.211. Infrastructure monitoring shows that the address is currently listed on three independent security blocklists, and the domain itself is blocked by the PhishDestroy, MetaMask, and SEAL filtering services.

VirusTotal scans report that four of ninety‑one antivirus engines have flagged the domain as malicious, providing additional corroboration of its hostile intent. Although the specific payload or credential‑harvesting page has not been publicly documented, the convergence of blocklist entries, multi‑vendor detections, and the recent registration date suggest a purpose‑built operation rather than an accidental or legacy compromise.

Defenders should immediately add finance39-et65.pro to local deny lists, enforce outbound DNS filtering for the associated IP, and monitor for any traffic patterns that target the same address space. Continuous re‑evaluation is advised, as further threat‑intel feeds may reveal additional indicators such as page titles, SSL certificate details, or associated command‑and‑control endpoints.