moonzonet[.]com

Analysis of the domain moonzonet.com indicates active credential phishing infrastructure targeting users under the guise of an 'OpenCode Setup' platform. The domain, registered on May 15, 2026, through Tucows Domains Inc., currently resolves to IP address 104.21.93.242, hosted on Cloudflare infrastructure in Canada. The page title, 'OpenCode Setup — Ship Faster. Build Smarter. | Miami,' suggests an attempt to impersonate a development or productivity tool, though no specific legitimate brand affiliation has been confirmed in available data. The domain is flagged by 26 of 92 security vendors on VirusTotal and appears in 15 threat intelligence pulses on AlienVault OTX, corroborating its malicious classification. It is currently blocked by PhishDestroy and CryptoFirewall, and holds a trust score of 0/100. Nameservers betty.ns.cloudflare.com and maxim.ns.cloudflare.com are consistent with Cloudflare-hosted phishing campaigns, which often leverage the provider's CDN to obscure origin servers and evade takedowns. Defenders should treat this domain as high-risk for credential harvesting. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as phishing sites frequently use valid certificates to appear legitimate. The HTTP 200 status confirms the page is accessible, and its presence on multiple blocklists indicates ongoing abuse. No evidence of a specific phishing kit or targeted sector (e.g., financial, corporate) is available at this time. Network defenders are advised to block the domain and associated IP, monitor for related infrastructure, and alert users to avoid interaction with any content hosted on moonzonet.com.