obmencashx[.]com

The domain obmencashx.com is currently active and identified as a generic phishing site targeting users with a cash‑exchange theme. The site returns HTTP 200 responses and presents the page title “CASH CHANGE,” matching the observed malicious content. Its risk rating is high, reflecting the combination of recent registration, active hosting, and low trust scores.

Infrastructure analysis shows the domain was registered on May 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Authoritative DNS is hosted on Cloudflare, using the nameservers rudy.ns.cloudflare.com and vita.ns.cloudflare.com. The domain resolves to IP address 188.114.97.3, which belongs to Cloudflare, Inc. and is geolocated to Canada. TLS is provided by a Let’s Encrypt certificate signed by the E7 intermediate, indicating a standard automated certificate issuance process.

Threat intelligence sources corroborate malicious activity. The domain appears in a single AlienVault OTX pulse and is listed on one external security blocklist. VirusTotal scans show three out of ninety‑five security vendors flag the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility of the site. PhishDestroy has already blocked the domain, demonstrating that at least one anti‑phishing service has taken mitigation action.

Defenders should prioritize blocking obmencashx.com at network perimeter and DNS layers, and consider adding its resolving IP 188.114.97.3 to deny‑list rules. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is advisable, as the provider can host multiple malicious actors. Security teams should also update email filtering policies to detect references to “CASH CHANGE” or related lure language, and share observed indicators with broader threat‑sharing communities to accelerate detection of related campaigns.