moontaurus[.]top

The domain moontaurus.top was registered on February 21 2026. Within weeks it surfaced in security telemetry and has been listed on a single public blocklist. VirusTotal analysis shows that four of ninety‑three scanning engines flagged the domain, indicating the presence of malicious content despite the majority of scanners not detecting it. The Gridinsoft trust score of zero reinforces the assessment that the site is untrusted. The site serves an SSL certificate classified as R12, which offers minimal validation and is commonly used by malicious operators to lend a false sense of legitimacy.

DNS resolution points to the IP address 15.197.130.221, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Hosting on a major cloud provider does not by itself imply benign activity, but it provides the attacker with scalable infrastructure and can obscure the true origin of the payload. The page title returned by the HTTP response is simply “moontaurus.top”, offering no additional context about the intended victim or impersonated brand. The domain is currently marked as offline, and PhishDestroy has already added it to its blocklist, reducing immediate exposure to end users.

Uncertainty remains regarding the exact phishing campaign vector, the credential‑stealing kit employed, and any associated command‑and‑control infrastructure, as no further artefacts such as landing‑page screenshots or URLs have been disclosed. Defenders should update internal blocklists with the IPv4 address 15.197.130.221 and the domain name, enforce TLS inspection to capture any hidden payloads, and monitor for any resurgence of the domain or related sub‑domains. Continuous querying of VirusTotal and other multi‑engine scanners is recommended to capture new detections, and any alerts from endpoint protection that reference the four detecting vendors should be investigated promptly.