data-finanzas-cdmxi[.]live

Analysis of the domain data-finanzas-cdmxi.live shows a recently created infrastructure that aligns with high‑risk phishing activity. The domain was registered on July 10, 2026 through Dynadot Inc. and is serviced by Cloudflare nameservers (princess.ns.cloudflare.com and tom.ns.cloudflare.com). DNS resolution points to the IP address 172.67.207.155, which is part of Cloudflare’s global edge network, a common hosting choice for fast‑flux or redirector setups used by threat actors to hide origin servers. VirusTotal scans have flagged the domain in seven of ninety‑one security vendor engines, indicating that multiple independent tools have observed malicious characteristics. The domain is listed on one public security blocklist and has been explicitly blocked by PhishDestroy, reinforcing the classification as an active phishing threat. Risk scoring from the supplied intelligence rates the domain as high, and its status remains active as of the report date, July 20, 2026. Concrete evidence is limited to registration data, DNS configuration, IP location, and the detection counts; no public SSL certificates, HTTP response codes, page titles, or brand‑specific lure information have been disclosed. Consequently, defenders lack full visibility into the exact payload or credential‑harvesting mechanisms employed. Given the confirmed detections and blocklist presence, security teams should immediately add data-finanzas-cdmxi.live to URL filtering and DNS‑blocking policies, monitor for any outbound traffic to the associated Cloudflare IP, and consider sharing the indicator with broader threat‑intelligence feeds. Continuous re‑evaluation is advised, as additional observables such as page content or SSL details may emerge, potentially refining the threat profile.