money-clear[.]info

The domain money-clear.info was observed hosting a brand‑impersonation campaign targeting the CS:GO brand. Registration was performed through Cloudflare, Inc., and the authoritative nameservers are lindsey.ns.cloudflare.com and rayden.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution points to IP address 172.67.72.114, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The site presented an HTTPS certificate issued by Let’s Encrypt (R13), confirming that encryption was in place at the time of capture.

The page title returned by the server was “Money Clear,” which does not directly reference the targeted brand but is consistent with the observed naming convention. Threat‑intelligence feeds have recorded the domain on a single security blocklist and it was actively blocked by the PhishDestroy service. VirusTotal analysis returned three positive detections out of ninety‑five scanners, reinforcing the malicious assessment. Gridinsoft’s trust score for the domain is 0 out of 100, indicating an extremely low reputation.

The campaign status is listed as “taken offline,” so the content is no longer reachable for direct inspection, limiting current visibility into the exact phishing page layout or credential‑harvesting mechanisms. Given the available evidence, defenders should continue to monitor the associated IP address and Cloudflare nameserver pair for re‑use, add money-clear.info to internal deny lists, and enforce URL filtering that blocks connections to the domain. Because the infrastructure relies on a shared Cloudflare edge, future malicious sites may reuse the same IP range; therefore, broader network‑level controls that restrict traffic to Cloudflare‑hosted IP blocks flagged by threat feeds are advisable. Continuous re‑scanning of the domain, should it reappear, will be necessary to capture any changes in payload or hosting configuration.