unlockmoney[.]org

unlockmoney.org was first observed on April 28, 2026 and is currently serving a page titled “Cryptomus Exchange | Crypto Invoice”. The site returns HTTP 200 and presents a TLS certificate issued by Let’s Encrypt (E8). The content mimics a cryptocurrency exchange invoice, a classic vector for credential harvesting. The threat classification has been recorded as generic_phishing with a high risk rating, and the domain remains active as of the report date, July 12, 2026.

Infrastructure analysis shows the domain resolves to 188.114.97.3, an address owned by Cloudflare, Inc. in Canada. The authoritative nameservers are sam.ns.cloudflare.com and walk.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting a lack of legitimate reputation. No additional hosting details are disclosed beyond the Cloudflare front‑end.

Multiple threat‑intel sources have already flagged unlockmoney.org. It appears on three security blocklists and has been listed by PhishDestroy, MetaMask, and SEAL as a malicious host. Google Safe Browsing reports a SOCIAL_ENGINEERING classification, and AlienVault OTX references the domain in a single pulse. Registration records list Fewmoretaps OU doing business as Trustname.com as the registrar, providing a plausible but suspicious corporate veneer.

Defenders should prioritize blocking traffic to unlockmoney.org at perimeter and DNS layers. Continuous monitoring of the associated IP address and Cloudflare name servers is advised, as the infrastructure could be repurposed for additional campaigns. Incident response teams should treat any credential or wallet information submitted to the site as compromised and advise affected users to rotate credentials and verify wallet addresses. Ongoing intelligence gathering is recommended to detect any evolution of the phishing kit or new indicators of compromise.