moneylist[.]app

This domain, moneylist.app, is flagged as a generic phishing site specializing in fake login portals designed to harvest user credentials. Analysis indicates no direct association with known brand impersonation campaigns or crypto drainer kits, but the infrastructure aligns with credential theft operations. The site presents a 404 error, suggesting either a takedown attempt or temporary concealment of malicious content, a common tactic to evade automated detection systems. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 50.87.144.173 and was registered through Name.com, Inc on February 20, 2020. VirusTotal reports 1 out of 95 security vendors flagging the domain as malicious, while the Gridinsoft trust score is 0 out of 100, indicating high suspicion. The domain appears on one security blocklist, and its current status is offline, though this does not preclude reactivation. Google Safe Browsing (GSB) does not list the domain, but the low detection rate may reflect limited visibility or evasion techniques. Current status shows the domain as offline, likely due to enforcement actions or voluntary takedown by the registrar. However, the elevated risk level persists due to the domain's history and infrastructure. Users are advised to treat any prior interactions with this domain as compromised, particularly if credentials were entered. Organizations should monitor for related indicators of compromise, including the IP address and registrar details, and update blocklists to prevent future access. The domain's age and low detection rate underscore the need for continuous vigilance, as threat actors frequently repurpose older domains for malicious campaigns.