storage[.]money

The domain storage.money was registered on March 11, 2026 through Marcaria International LLC and is currently active. DNS resolution points to IP address 84.200.17.155, which is hosted in Germany under AS214036 (Ultahost, Inc.). The domain uses three authoritative name servers—ns1.w30.dev, ns2.w30.dev, and ns3.w30.dev—and serves an HTTPS certificate issued by Let’s Encrypt (E8). An HTTP request receives a 302 redirect response, and the observed page title is "Money Storage." Infrastructure analysis identifies Nginx as the web server, with client‑side libraries jQuery, jQuery UI, and Google Analytics present. The site has been blocked by PhishDestroy and appears on one external security blocklist. VirusTotal reports a single detection out of 95 scanned vendors. The risk rating is high, and the threat type is classified as generic phishing. While the page title is known, the specific content and any credential‑capture mechanisms have not been publicly disclosed. Defenders should add storage.money to network‑level blocklists, monitor DNS queries for the associated name servers, and consider sinkholing the IP to disrupt traffic. Continuous telemetry from security vendors should be reviewed for additional detections, and any observed malicious redirects should be logged for incident response.