whitemoney[.]io

This domain is flagged as generic phishing and remains active. Registration occurred on December 01, 2024 through CommuniGal Communication Ltd. The domain resolves to IP 199.59.243.228 in the United States under AS16509 Amazon.com, Inc. HTTP status returns 301 and the SSL certificate is issued by Let's Encrypt under identifier E8. The page title matches the domain name directly. These elements establish the current operational profile without additional context on hosted content.
Infrastructure analysis reveals nameservers ns1.abovedomains.com, ns15.abovedomains.com, ns16.abovedomains.com, and ns2.abovedomains.com. The domain sits on one security blocklist and carries a Gridinsoft trust score of 0 out of 100. VirusTotal detection stands at 1 out of 95 vendors. The combination of recent registration, specific nameserver cluster, and low but present detection count indicates deployment patterns typical of short-lived phishing infrastructure.
Defenders reviewing traffic logs should treat any connections to 199.59.243.228 or the listed nameservers as high priority for blocking. Existing blocklist entries already provide a starting point for firewall or DNS sinkhole rules. Continued monitoring for changes in IP resolution or certificate renewal remains necessary because the domain is still resolving.
Uncertainties persist around the precise redirection target after the 301 response and the exact payload delivered to visitors, as page content beyond the title has not been examined. Recommended steps include adding the domain and IP to internal block lists, sharing the indicator set with sector partners, and reviewing proxy or mail gateway logs for related attempts. The single blocklist appearance and low vendor count underscore that external detections alone are insufficient for complete coverage.