news[.]worldcoin[.]com[.]mx

The domain news.worldcoin.com.mx is currently active and classified as a high‑risk generic phishing site. Infrastructure analysis shows it resolves to the IPv6 address 2606:4700:10::6814:24ab, which belongs to Cloudflare (AS13335) and is served through Cloudflare nameservers josephine.ns.cloudflare.com and watson.ns.cloudflare.com. The site issues a 301 redirect and presents a TLS certificate issued by Google Trust Services under the WE1 label, with HSTS enabled. Detected technologies include Vercel, PostHog, and Cloudflare. Reputation data indicates a Gridinsoft trust score of 0 / 100, presence on a single security blocklist, and active blocking by PhishDestroy. VirusTotal reports three detections out of ninety‑five scanned vendors. The domain was registered on 25 June 2023 via Telmex and carries the page title “The real human network,” a phrase likely used to entice victims. While the exact content and phishing payload have not been publicly disclosed, the combination of a legitimate‑looking title, active TLS, and known phishing classification suggests the site is being used to harvest credentials or personal data. Defenders should block the domain at perimeter and DNS layers, add it to threat‑intel feeds, and monitor for related traffic patterns. Continuous scanning of the site’s content and periodic re‑evaluation of its reputation scores are recommended to detect any changes in malicious behavior.