money-x[.]one

The domain money-x.one was registered on May 16, 2026 through Spaceship, Inc. and is served by Cloudflare nameservers itzel.ns.cloudflare.com and maxim.ns.cloudflare.com. DNS resolution points to the IPv4 address 193.233.63.55, which is geolocated to Argentina and associated with the operator Safe Value Limited. Infrastructure analysis shows the host uses a Let’s Encrypt certificate (R12) and returns an HTTP 301 status code, indicating a permanent redirect. The IP address appears on three security blocklists and is currently blocked by PhishDestroy, MetaMask, and SEAL. The domain is listed in a single AlienVault OTX pulse, and Gridinsoft assigns it a trust score of 0 out of 100. Threat intelligence classifies money-x.one as a high‑risk generic phishing site. The page title observed during retrieval is “Money‑X – первый безопасный сервис быстрых игр,” suggesting an attempt to masquerade as a legitimate Money‑X service. The site remains active as of the report date and has not yet generated any detections on VirusTotal (0/95), though the lack of detections does not imply benign intent. Defenders should proactively block the domain and its resolving IP address at perimeter and endpoint controls. Monitoring for new TLS certificates or changes to the underlying IP can provide early warning of potential re‑hosting. Because the domain is already listed on multiple blocklists, integrating those feeds into security information and event management (SIEM) pipelines will improve detection of inbound traffic. Continuous re‑evaluation is advised, as the threat actor may modify the URL or host additional phishing pages under the same infrastructure.