# moneyfirst.xyz — SUSPICIOUS

> moneyfirst.xyz is under investigation for fake banking login phishing. Domain created August 01, 2025, 0/95 VirusTotal detections. Check the full report.

## Summary
PhishDestroy identifies moneyfirst.xyz as a suspected fake banking login scam page designed to steal your online banking credentials. The site mimics a legitimate financial login portal, tricking visitors into entering their usernames and passwords, which are then harvested by cybercriminals. This type of attack is particularly dangerous because it can lead to direct financial loss and unauthorized access to bank accounts. The domain appears to target users looking for financial services or banking solutions, making it a high-risk threat to personal and financial security.  

 This domain was flagged with 0 detections out of 95 VirusTotal scans, which suggests it may be newly active or using evasion techniques to avoid detection. The domain moneyfirst.xyz was created on August 01, 2025, and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 188.114.97.3 and holds a valid SSL certificate issued by Google Trust Services, which may lend it an air of legitimacy. However, these technical indicators are common among phishing sites that aim to appear trustworthy while deploying malicious intent.  

 If you visited moneyfirst.xyz, do not enter any personal or financial information. Immediately close the browser tab and clear your browsing data, including cached passwords. Use a reputable antivirus or anti-malware tool to scan your device for any potential infections. Report the domain to your bank or financial institution if you used banking credentials on the site. Stay vigilant and avoid clicking on suspicious links or ads promising financial services. For further safety guidance, consult PhishDestroy’s full investigation report for this domain.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-08-01 14:37:15
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/cdf30863-8455-4c0c-9bcf-b962b99ad02d
- PhishDestroy: https://phishdestroy.io/domain/moneyfirst.xyz/
- LLM endpoint: https://phishdestroy.io/domain/moneyfirst.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/moneyfirst.xyz/
Last updated: 2026-03-27