mooncake[.]life

mooncake.life is a newly registered domain (created 29 Mar 2026) that currently hosts a page titled “MOONCake | Mid‑Autumn Lucky Page”. The site is hosted on infrastructure identified as Firebase and Unpkg, fronted by Cloudflare with HTTP/3 support. DNS resolution points to IP 216.24.57.1, an address associated with a Render hosting environment in the United States. The domain is delegated to GoDaddy’s name servers ns33.domaincontrol.com and ns34.domaincontrol.com and presents a Google Trust Services/WE1 TLS certificate. Gridinsoft assigns a trust score of 0/100 and the domain appears on a single security blocklist, where it is listed by PhishDestroy as a “Fake Airdrop” campaign. No additional detection data is available from VirusTotal. The operational status is marked as active and the investigation status is “under_investigation”. Evidence suggests the site is being used to lure victims with a fraudulent airdrop promise tied to the “MOONcake” theme, but the exact mechanics of the lure have not been disclosed. Defenders should block the domain at the perimeter, monitor DNS queries for the associated IP and name servers, and flag any traffic to Firebase or Unpkg endpoints originating from internal users. Continuous observation is advised to detect any escalation, such as the addition of credential‑collection forms or malicious payloads.