luna-startx[.]net

The domain luna-startx.net is currently classified as a generic phishing threat. Analysis indicates that this domain was actively used to deceive users through fraudulent web pages, though no specific brand impersonation has been confirmed in available intelligence. The domain is presently offline, but prior activity suggests it was designed to harvest credentials or distribute malicious content under the guise of legitimate services. Infrastructure analysis reveals that luna-startx.net was registered through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 104.21.65.65, a Cloudflare-associated address often leveraged to obfuscate malicious infrastructure. As of the latest assessment, the domain has been flagged by 4 of 95 security vendors on VirusTotal, indicating moderate detection but persistent risk. It appears on one security blocklist and was previously blocked by PhishDestroy. The page title, "רק רגע..." (translating to "Just a moment..." in Hebrew), suggests targeting of Hebrew-speaking users, potentially as part of a localized phishing campaign. The domain was created on October 7, 2025, further corroborating its recent and likely short-lived operational intent. Current status confirms that luna-startx.net has been taken offline, reducing immediate exposure. However, the infrastructure remains a latent risk, as domains registered through similar channels often reappear under altered configurations. Organizations and users are advised to block the domain and its associated IP at the network perimeter. Security teams should monitor for related indicators, including the registrar and hosting patterns, to preemptively disrupt recurring threats. End users who may have interacted with the domain should verify account integrity, reset credentials, and scan systems for unauthorized access or malware.