molavest[.]cfd

Analysis of the domain molavest.cfd, created on 20 March 2026 and currently taken offline, indicates a medium‑level threat associated with a crypto‑scam campaign. The domain resolves to the IPv4 address 43.169.13.15, which is geolocated to Singapore (ACE) and is served by nameservers ns1.teodns.com and ns2.teodns.com. The TLS certificate presented by the host is issued to TrustAsia Technologies, Inc., a certificate authority commonly observed in malicious infrastructure. VirusTotal reports that four of ninety‑five scanning engines flag the domain, providing modest but notable detection confidence.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a malicious resource. The registrar information shows the domain was registered through Aceville Pte. Ltd., a corporate entity often used for short‑lived malicious registrations. The only page title retrieved is "Access Restricted," suggesting that the site may have been deliberately limited or taken down after initial activity. No additional content, brand impersonation, or phishing landing page details have been captured, leaving the exact payload and victim‑targeting mechanisms uncertain.

Defenders should add 43.169.13.15 to network‑level deny lists, block molavest.cfd at DNS resolvers, and monitor for any future re‑registration attempts. Continuous telemetry from URL filtering and endpoint protection solutions should be correlated with the four VirusTotal detections to improve detection accuracy. Given the crypto‑scam designation, organizations handling cryptocurrency transactions should prioritize awareness of this indicator and consider heightened scrutiny of outbound connections to the identified IP range.