moneroflip[.]com

Analysis of moneroflip.com shows a newly registered domain created on February 21, 2026 and hosted by NameCheap, Inc. The site resolves to the IPv4 address 185.196.9.97, which is assigned to AS42624 Global-Data System IT Corporation in Switzerland. The server stack reports Ubuntu operating system, Nginx web server, and a modern JavaScript stack comprising Node.js, React, Next.js, Webpack, and HSTS enforcement, indicating a deliberately built front‑end likely intended to appear legitimate. The domain presents the page title "MoneroFlip," but no further content has been examined publicly.

The SSL certificate is issued by Let’s Encrypt (E8), confirming encrypted transport but offering no assurance of authenticity. Reputation checks reveal a Gridinsoft trust score of 0 out of 100 and presence on a single security blocklist, while PhishDestroy has explicitly blocked the domain. VirusTotal scans show three of ninety‑three security vendors flagging the domain, reinforcing the suspicion of malicious intent.

The domain is currently offline, which may be a takedown or a temporary cessation of service. Defenders should continue to block DNS resolution to 185.196.9.97, enforce URL filtering for the exact host name, and monitor the registrar’s nameservers (dns1.registrar-servers.com and dns2.registrar-servers.com) for any re‑hosting attempts. Incident response teams should also treat any future re‑appearance of the moneroflip.com URL as potentially hostile, given the existing phishing classification and the technical infrastructure that aligns with typical credential‑stealing operations.