mossad[.]cash

The domain mossad.cash was created on June 12, 2026 via NameCheap, Inc. It resolves to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. and geolocated in Canada. Authoritative name servers guss.ns.cloudflare.com and maleah.ns.cloudflare.com confirm that the domain relies on Cloudflare’s DNS and DDoS mitigation platform for its public‑facing services.

Threat intelligence platforms have consistently identified the domain as a phishing vector. Google Safe Browsing flags it under the SOCIAL_ENGINEERING category, and AlienVault OTX includes the domain in four separate pulses. The site appears on three public security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows six of ninety‑five scanners marking the site as malicious, providing independent confirmation of its malicious intent.

The hosted page bears the title “Registrant WHOIS contact information verification | Namecheap.com,” a common social‑engineering lure that mimics official registrar communications to harvest credentials. The web server presents a valid TLS certificate issued by Google Trust Services (WE1) and enforces HTTP Strict Transport Security, while also supporting HTTP/3. Although these transport‑level protections mitigate man‑in‑the‑middle attacks, they do not diminish the underlying phishing risk.

Defenders should immediately add mossad.cash to URL filtering, email gateway, and DNS sinkhole policies to block outbound connections. Monitoring for DNS queries to the Cloudflare name servers guss.ns.cloudflare.com and maleah.ns.cloudflare.com can provide early warning of internal accesses. Incident response teams ought to capture and hash any files or scripts delivered from the site, then share those indicators with upstream threat feeds. Ongoing surveillance is recommended, as the infrastructure could be repurposed for additional phishing campaigns targeting other brands.