money-receive[.]bond

Analysis of the domain money-receive.bond, observed on 2026-08-06, indicates that it is being used for a generic phishing campaign. The domain was registered through Global Domain Group LLC on 2026-08-01 and is hosted on Cloudflare infrastructure, as evidenced by the authoritative name servers yahir.ns.cloudflare.com and ziggy.ns.cloudflare.com. DNS resolution points to the IP address 172.67.172.221, which is part of Cloudflare's network and does not reveal a distinct backend host. The domain has been added to a security blocklist and is currently blocked by the PhishDestroy service; it appears on one known blocklist at the time of analysis. VirusTotal records show that the domain was scanned by 91 anti-malware vendors, and none of those scanners have raised a detection flag to date.

The absence of detections should not be interpreted as confirmation of safety, nor as evidence of maliciousness, given the limited time since domain creation. The short lifespan of the domain (five days) and the immediate appearance on a phishing blocklist suggest an intentional, rapid-deployment operation typical of credential-harvesting campaigns. No public evidence of SSL/TLS certificates, HTTP response codes, page titles, or additional threat-intel feeds such as OTX or Google Safe Browsing is available, leaving the surface-web content unverified. Consequently, the exact phishing vector, target brand, or credential collection method remains unknown. Defenders should proactively block DNS resolution for money-receive.bond at the network perimeter and add the domain to existing URL filtering policies.

Monitoring of outbound traffic to the associated IP address 172.67.172.221 is recommended, as Cloudflare-hosted malicious domains can share infrastructure with other active threats. Continuous re-scanning with multi-vendor services, including VirusTotal, should be scheduled to capture any later detections.