momocoin[.]pro

Analysis of the domain momocoin.pro, observed on July 24, 2026, indicates that it is currently offline but was previously active as a generic phishing site. The domain was registered through Cloudflare, Inc., and its authoritative name servers are amos.ns.cloudflare.com and dayana.ns.cloudflare.com, both operated by Cloudflare. DNS resolution points to the IP address 172.67.223.125, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate was found for the site, suggesting that any communication would have occurred over plain HTTP.

The page title returned by the site was "Un instant…", providing no direct indication of the targeted brand or service. VirusTotal recorded five detections out of ninety‑five security vendors, demonstrating that multiple scanners flagged the domain as malicious. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, reinforcing its classification as a phishing vector.

AlienVault OTX references the domain in one threat‑intelligence pulse, adding an additional source of corroborating evidence. Given the combination of vendor detections, blocklist inclusion, and the lack of encryption, defenders should continue to block any traffic to momocoin.pro, monitor for related infrastructure reuse, and update internal threat‑intel repositories with the observed indicators of compromise. The offline status does not guarantee cessation of activity; threat actors may re‑host the payload on new domains, so ongoing vigilance is advised.