app[.]moonwell[.]cam

This domain, app.moonwell.cam, is flagged as a high-risk generic phishing threat. Registered on April 27, 2026, through Dynadot LLC, it remains active as of July 12, 2026. Infrastructure analysis shows the domain resolves to IP address 104.21.93.122, hosted by Cloudflare, Inc. in the United States. The domain uses nameservers ashton.ns.cloudflare.com and teresa.ns.cloudflare.com, and its SSL certificate is issued by Let's Encrypt. The page title is "Just a moment..." and returns an HTTP 403 status, indicating access is blocked or restricted. Security telemetry includes 3 out of 91 vendors on VirusTotal flagging the domain as malicious, and it appears on one security blocklist. The Gridinsoft trust score is 0 out of 100, reinforcing the high-risk assessment. The exact nature of the phishing campaign is not yet determined from available data, as the page content has not been analyzed. Defenders should treat this domain as actively hostile, block all traffic to app.moonwell.cam and its associated IP address, and monitor for any related subdomains or infrastructure changes.