moonlander-dex[.]com

Analysis of moonlander-dex.com indicates this domain is under investigation for phishing activity targeting cryptocurrency users. The domain was registered on July 20, 2026, through UnstoppableUS2 LLC, with nameservers ns1.unstoppabledomains.com and ns2.unstoppabledomains.com. It currently resolves to the IP address 186.2.175.103, which has not been extensively profiled in public threat intelligence feeds as of this report. The domain appears on one security blocklist, specifically PhishDestroy, which suggests preliminary detection by at least one vendor, though the absence of additional blocklist entries or vendor detections does not confirm safety. VirusTotal scans conducted by 95 vendors returned no flags, but this should not be interpreted as conclusive evidence of legitimacy. The domain remains active, and its infrastructure—including the use of Unstoppable Domains nameservers—aligns with patterns observed in phishing campaigns leveraging decentralized naming services to evade traditional takedown mechanisms. No SSL certificate details, HTTP response codes, or page content analysis are currently available, limiting further assessment of its operational status or specific targeting methods. Defenders should treat moonlander-dex.com as a potential threat, particularly in environments where cryptocurrency transactions or decentralized exchange (DEX) interactions occur. Monitoring for connections to 186.2.175.103 and domain resolution attempts is recommended. If additional indicators emerge—such as associations with known phishing kits, malicious subdomains, or confirmed victim reports—this domain should be escalated for immediate blocking. Given the recent registration and active status, organizations are advised to maintain heightened scrutiny until further evidence clarifies its intent or threat level.