dumbmoney-checker[.]sbs

Analysis confirms that the domain dumbmoney-checker.sbs is associated with a high-risk generic phishing campaign. The domain was registered on April 17 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to the Cloudflare-owned address 188.114.96.3, which is geolocated to Canada. The DNS zone is served by the Cloudflare nameservers june.ns.cloudflare.com and nikon.ns.cloudflare.com, and the site presents a valid Let’s Encrypt certificate (issuer E7) despite returning an HTTP 403 response to direct requests.

Threat‑intel sources indicate limited but notable exposure. The domain appears in a single AlienVault OTX pulse and is listed on three public blocklists. Additionally, it is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services. VirusTotal analysis shows that three out of ninety‑five scanners have flagged the domain as malicious, reinforcing the suspicion of phishing activity.

While the 403 status prevents immediate observation of the payload, the combination of a recent registration, use of a trusted TLS certificate, and placement behind Cloudflare suggests an attempt to lend legitimacy and evade simple reputation checks. The exact phishing lure—whether it targets financial services, cryptocurrency wallets, or other credentials—remains unconfirmed due to the lack of observable content.

Defenders should add dumbmoney-checker.sbs to deny-list rules across perimeter firewalls, proxy appliances, and endpoint protection platforms. Continuous monitoring of DNS queries for the associated IP and nameservers is advised, as well as periodic rescans on VirusTotal to capture any changes in detection ratios. Network traffic to the domain should be logged and, where possible, redirected to a sinkhole for further forensic collection.