monexa-hollding[.]com

Analysis of the domain monexa-hollding.com shows a recently created web presence that was taken offline after detection. The domain was registered on February 21, 2026 through Tucows Domains Inc. and points to the Cloudflare address 172.67.186.2, which is associated with AS13335 in the United States. DNS resolution uses the Cloudflare authoritative nameservers leah.ns.cloudflare.com and marty.ns.cloudflare.com. No TLS certificate is present, indicating that the site was served over plain HTTP before being removed. The page title observed during the brief active period was "Home - Monex Holding," and the underlying stack includes WordPress, MySQL, PHP, and common front‑end libraries such as jQuery, Swiper, and UIKit, confirming a typical content‑management system deployment.

The site was classified as a banking phishing campaign that impersonates the financial brand celer. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reported a single positive detection out of ninety‑five scanning engines. These indicators collectively suggest a low‑quality, short‑lived phishing infrastructure that relied on a generic WordPress install and Cloudflare’s CDN to obscure its origin.

Uncertainty remains regarding the exact phishing payload, credential‑capture mechanisms, or any additional command‑and‑control infrastructure, as no further artifacts such as malicious scripts or phishing pages have been captured. Defenders should add monexa-hollding.com to internal blocklists for DNS and URL filtering, monitor for any sub‑domains or similar registrations that target the celer brand, and enforce HTTPS‑only policies to prevent future abuse of unsecured endpoints. Email security gateways should be tuned to flag communications referencing the brand celer that originate from unauthenticated or newly registered domains.