mnply-money[.]world

Analysis of the domain mnply-money.world indicates active deployment of a phishing kit designed to harvest credentials. Registered through Cloudflare, the domain resolves to 188.114.97.3, an address assigned to AS13335. As of July 12, 2026, twelve out of ninety-five security vendors on VirusTotal flag the domain as malicious, while four distinct blocklists include it in their denylists. The domain remains operational, returning an HTTP 403 status, which suggests access restrictions or protective measures to evade automated crawlers. The page title 'Nur einen Moment…' is consistent with temporary holding or interstitial pages commonly used in phishing campaigns to delay or redirect victims. Infrastructure analysis reveals the use of Cloudflare nameservers (audrey.ns.cloudflare.com and lewis.ns.cloudflare.com) and technologies including HSTS, Cloudflare Browser Insights, and HTTP/3, which may be leveraged to obscure malicious activity. The SSL certificate issued by Google Trust Services (WE1) provides encryption but does not validate the legitimacy of the site. No specific brand impersonation or scam category has been confirmed in available data, though the domain name suggests a financial or monetary theme. Uncertainties remain regarding the exact nature of the phishing content, as the site has not been directly accessed for analysis. The HTTP 403 response may indicate that the phishing pages are selectively served or require specific conditions to trigger. Defenders should treat this domain as high-risk and include it in network-level blocking rules. Monitoring for connections to 188.114.97.3 or the domain itself in proxy, DNS, and endpoint logs is recommended to detect potential compromise. If observed, credentials entered on this domain should be considered exposed and rotated immediately.