x-money[.]run

The domain x-money.run was registered on April 15, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. Since registration, the domain has been observed actively serving malicious content and is currently listed as high‑risk. Blocklists such as PhishDestroy, MetaMask, and SEAL have already added the domain to their deny lists, confirming its ongoing abuse.

Network resolution points to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. and is geolocated in Canada. The domain relies on Cloudflare’s authoritative name servers maya.ns.cloudflare.com and amos.ns.cloudflare.com, and presents a valid Let’s Encrypt certificate (issuer E8). An HTTP request to the root returns a 403 status, indicating that the front‑end is likely protected or intentionally hidden.

Aggregated scanning on VirusTotal shows that 16 out of 95 security vendors flag the domain as malicious, reflecting a moderate consensus among automated scanners. The domain also appears on three independent security blocklists, further reinforcing the classification as a generic phishing vector. The limited vendor consensus suggests that the payload or landing page may be intermittently active, complicating automated classification. No additional indicators such as associated malware families or command‑and‑control endpoints have been disclosed.

Defenders should immediately block DNS resolution for x-money.run and any subdomains, enforce outbound filtering to prevent connections to 188.114.96.3, and monitor for similar Cloudflare‑hosted infrastructure that may be leveraged for credential‑stealing campaigns. Continuous re‑scanning of the domain is advised, as the content behind the 403 response may evolve, and any new detection from additional vendors should be incorporated into detection rules.