x-money[.]lat

This domain, x-money.lat, is flagged as an active generic phishing site targeting financial service users. Registered on March 7, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to IP 188.114.97.3, hosted on Cloudflare’s network (AS13335). Nameservers audrey.ns.cloudflare.com and rohin.ns.cloudflare.com further confirm Cloudflare infrastructure. The domain currently returns an HTTP 403 status with the page title 'Just a moment...', a common Cloudflare interstitial, suggesting the phishing content may be intermittently accessible or protected by anti-bot measures. Analysis indicates the domain has been detected by three security blocklists, including PhishDestroy, MetaMask, and SEAL. A Gridinsoft trust score of 0/100 reflects high-risk classification. While VirusTotal reports two detections out of 94 vendors, this does not rule out malicious activity, as phishing domains often evade initial scans. The SSL certificate, issued by Let’s Encrypt (E7), is standard for both legitimate and malicious sites and provides no inherent trust signal. Defenders should treat this domain as high-risk. The Cloudflare hosting and 403 response may indicate attempts to evade automated crawlers, so manual verification or sandboxed analysis is recommended if further details on the phishing kit or target brand are required. Blocking the domain at the DNS or network level is advised, along with monitoring for related subdomains or newly registered lookalike domains. The lack of explicit brand targeting in available data suggests a generic financial phishing campaign, but the exact content remains unconfirmed due to restricted access.