app[.]mmt-finance[.]com

This domain, app.mmt-finance.com, was registered on 12 October 2025 through Tucows Domains Inc. and is currently active. The authoritative nameservers 1-you.njalla.no, 2-can.njalla.in, and 3-get.njalla.fo resolve the domain to the IP address 37.221.66.97, which belongs to AS48753 AVA HOST SRL located in Moldova. The web server returns HTTP 403 for all requests and does not present an SSL/TLS certificate, indicating that the site is served over plain HTTP. The page title observed is “Momentum | Move Central Liquidity Engine”, and the campaign is classified as a wallet/seed phishing operation that impersonates the brand “sui”.

Reputation services flag the domain as high risk: Gridinsoft assigns a trust score of 0 / 100, Scamadviser reports 26 / 100, and five of ninety‑five VirusTotal scanners have raised detections. The domain appears on two public blocklists, PhishDestroy and ScamSniffer, confirming that it is already being filtered by external threat‑intelligence feeds. No additional intelligence such as Safe Browsing or OTX entries is available, and the content of the site beyond the title has not been publicly disclosed.

Defenders should block traffic to 37.221.66.97 and to the domain name at the DNS level, enforce TLS inspection to capture the unencrypted HTTP exchange, and add the domain to internal phishing‑email detection rules. Continuous monitoring of the registrar’s WHOIS records and the three njalla nameservers is recommended, as changes may indicate further infrastructure evolution. Given the low trust scores, the presence on multiple blocklists, and the confirmed impersonation of a cryptocurrency brand, the domain should be treated as a high‑severity indicator of compromise.