reallocation-mmtfinance[.]app

On July 25, 2026 the domain reallocation-mmtfinance.app was observed to be offline but retains indicators of a phishing infrastructure. The domain is registered through Cloudflare, Inc. and uses Cloudflare’s DNS service, as evidenced by the authoritative nameservers hunts.ns.cloudflare.com and lovisa.ns.cloudflare.com. No SSL certificate was presented during the scan, indicating that the site was served over plain HTTP or that TLS was not configured. The resolved address 172.67.155.16 belongs to AS13335, Cloudflare, Inc., with the hosting location identified as the United States.

The landing page returned the title “Nur einen Moment…”, which is the only visible content captured. The domain appears on a single security blocklist and has been flagged by the PhishDestroy blocking service. Independent analysis on VirusTotal shows that four out of ninety‑five security vendors classified the domain as malicious, reinforcing the phishing assessment. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, further confirming the malicious nature.

Because the site is currently taken offline, active exploitation cannot be confirmed, but the combination of blocklist inclusion, low trust score, and multiple vendor detections provides strong evidence that the domain was used for phishing. Defenders should continue to block the domain at perimeter appliances, update URL filtering lists, and monitor for any future DNS resolutions to the same IP address or Cloudflare‑hosted infrastructure. Additional investigation of HTTP traffic logs for requests to reallocation-mmtfinance.app may reveal residual malicious activity. Continuous re‑scanning after the domain reappears is recommended to capture any changes in payload or hosting configuration.