moneybux[.]xyz

Analysis of the domain moneybux.xyz indicates it was actively involved in a cryptocurrency scam impersonating Telegram, as evidenced by its page title 'Money Bux - Earn TON for completing simple tasks.' The domain was registered on February 21, 2026, and resolved to the IPv6 address 2606:4700:3034::ac43:ce94, hosted on Cloudflare's infrastructure (AS13335) in the United States. At the time of assessment, the domain had been taken offline, though it remains listed on one security blocklist and was blocked by PhishDestroy. Gridinsoft assigned the domain a trust score of 0 out of 100, reflecting its high-risk classification.

Six out of 95 security vendors on VirusTotal flagged the domain as malicious, though the specific nature of the detections is not detailed in available intelligence. The SSL certificate was issued by WE1, a provider commonly used for both legitimate and malicious domains, offering no definitive indication of intent. No evidence of a phishing kit or additional infrastructure links was identified in the available data.

Defenders should treat this domain as confirmed malicious infrastructure, particularly for campaigns targeting Telegram users with fraudulent cryptocurrency offers. Historical DNS and WHOIS records should be preserved for further investigation, and any residual DNS resolutions should be monitored for reactivation attempts. The domain's brief operational window and Cloudflare hosting are consistent with patterns observed in ephemeral phishing campaigns.