mclub[.]ltd

This domain, mclub.ltd, is currently flagged as an active phishing site specifically targeting users of Money Club, a financial services platform. Analysis indicates the threat type is credential harvesting through brand impersonation, with the page title explicitly displaying 'Money Club' to deceive victims. The domain remains operational as of the latest verification, posing a high-risk threat to individuals interacting with financial services online. Infrastructure analysis reveals the domain was registered on January 28, 2025, through Web Commerce Communications Limited dba WebNic.cc. It resolves to the IP address 172.67.174.179, hosted on AS13335 Cloudflare, Inc. in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common pattern observed in phishing campaigns leveraging legitimate infrastructure to evade detection. VirusTotal detection shows 2 of 95 security vendors have flagged this domain as malicious, while it appears on 1 security blocklist. The domain is currently blocked by PhishDestroy, indicating prior identification of its malicious intent. Current assessment confirms mclub.ltd remains active and should be treated as a high-risk threat. Organizations and individuals are advised to implement immediate network-level blocking of the domain and its associated IP address (172.67.174.179). Endpoint protection systems should be updated to include this domain in phishing detection rules, particularly those monitoring for Money Club impersonation. Users who may have interacted with this domain should initiate credential reset procedures for any financial accounts, and security teams should monitor for anomalous authentication attempts originating from this infrastructure. Given the domain's recent registration and low detection rate, heightened vigilance is recommended for related phishing campaigns.