nest[.]io-dev[.]moonbirds[.]xyz

The domain nest.io-dev.moonbirds.xyz was created on 21 February 2026 and is currently serving HTTP 200 responses. Automated analysis classifies it as a generic phishing site targeting users of the Moonbirds brand. The page title returned by the server is "Moonbirds", matching the legitimate brand name and suggesting a credential‑harvesting front‑end. Registration was performed through Amazon Registrar, Inc., and the domain resolves to the authoritative nameservers abby.ns.cloudflare.com and huxley.ns.cloudflare.com. The hosting environment exhibits characteristics of a contemporary cloud‑based platform, implements HTTP Strict Transport Security, and loads a client‑side analytics script. The HTTP service presents a valid certificate and returns a successful status code, which can aid in bypassing naïve browser warnings. Threat intelligence sources have taken action against the domain: it appears on a single security blocklist, has been flagged by PhishDestroy, and one out of ninety‑five security scanners on a public multi‑engine service reported a malicious indication. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of high risk. No additional public reports or compromised credential dumps have been observed, leaving the scale of victimization uncertain. Defenders should block the domain at network perimeter and update endpoint protection rules to include the associated nameservers. Email security gateways should be tuned to detect URLs that resolve to the same infrastructure and to inspect messages referencing the Moonbirds brand. Continuous monitoring of the domain’s DNS and certificate attributes is advised, as rapid re‑hosting is common in phishing campaigns. Incident response teams should treat any credential submission to this site as potentially compromised and initiate user notification and password reset procedures.