luna-startx[.]com

Analysis of luna-startx.com shows a newly registered domain created on February 21 2026 that is being used to impersonate the x.com brand. The domain is registered through Web Commerce Communications Limited dba WebNic.cc and resolves to the Cloudflare address 172.67.156.112, which is located in the United States under ASN 13335. The site currently returns an offline HTTP status and has been taken down, but historical data indicate it was flagged by multiple security services. It appears on at least one public security blocklist and received a trust score of zero out of one hundred from Gridinsoft, indicating a high likelihood of malicious intent.

PhishDestroy has also listed the domain as blocked, and VirusTotal reports that two of ninety‑three scanning engines flagged the domain as malicious. The SSL certificate presented is identified as WE1, a generic certificate often associated with short‑lived phishing infrastructure. The page title observed during the brief live window was "Nur einen Moment…", which does not provide any brand‑specific content but confirms that a web page was served.

While the exact phishing kit or payload has not been disclosed, the convergence of a brand‑targeted impersonation, low trust scores, blocklist presence, and vendor detections strongly suggests a credential‑harvesting operation aimed at x.com users. Defenders should update URL filtering rules to block luna-startx.com, monitor for any traffic to the associated Cloudflare IP, and advise users to verify URLs before entering credentials. Continuous re‑scanning of the domain is recommended in case the site is re‑hosted or the infrastructure is repurposed.