monedadelmundo[.]com

The domain monedadelmundo.com is currently active and has been observed serving a generic phishing campaign. Registration data shows the domain was created through GoDaddy.com, LLC, and its authoritative name servers are malavika.ns.cloudflare.com and trace.ns.cloudflare.com, indicating use of Cloudflare’s DNS infrastructure. The site redirects with an HTTP 301 response and presents a TLS certificate issued by Google Trust Services under the WE1 label, confirming the presence of valid HTTPS. Email infrastructure includes MX entries pointing to in1-smtp.messagingengine.com (priority 10) and a secondary host at priority 20, suggesting reliance on a third‑party mail service. Threat intelligence sources note that the domain appears in one AlienVault OTX pulse and is listed on three public blocklists; VirusTotal scans have flagged the domain by 12 of 91 security vendors. The IP address 172.67.129.87 resolves to a Cloudflare network located in Canada. The domain is also blocked by commercial phishing mitigation services PhishDestroy, MetaMask, and SEAL. While the exact phishing payload and target victims have not been publicly disclosed, the combination of a legitimate‑looking TLS certificate, Cloudflare hosting, and third‑party mail routing is typical of campaigns designed to evade simple blocklists. Defenders should add monedadelmundo.com to URL filtering and email gateway block lists, monitor DNS queries for the associated Cloudflare nameservers, and enforce TLS inspection to detect any malicious content delivered over the encrypted channel. Continuous re‑evaluation is advised as the threat actor may modify hosting or certificate details.