moon-cypress[.]com

This domain, moon-cypress.com, was registered on June 15, 2026 through Namecheap Inc. and is currently resolving to 104.21.16.57, an address owned by AS13335 Cloudflare, Inc. The authoritative nameservers hans.ns.cloudflare.com and katja.ns.cloudflare.com confirm that the site is hosted behind Cloudflare’s edge network, which obscures the origin server. The site returns HTTP 200 and presents a TLS certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS connection despite the malicious intent.

The page title reported by crawlers is “moon‑cypress”, matching the domain name. Gridinsoft assigns the domain a trust score of 0 / 100, reflecting extreme suspicion. The domain appears on three security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that two of ninety‑five scanned security vendors have flagged the domain, which is consistent with its classification as a generic phishing site.

Risk rating is high and the status is listed as active. The combination of a newly created domain, use of a reputable CDN, a low trust score, and presence on multiple blocklists suggests an ongoing campaign targeting users with credential‑stealing pages. The limited number of vendor detections may indicate that many scanners have not yet incorporated the indicator, or that the payload is lightweight and evades static detection.

Defenders should add moon-cypress.com to URL filtering and DNS sinkhole rules, enforce TLS inspection to inspect encrypted traffic, and monitor for outbound connections to the Cloudflare IP range 104.21.16.57. Since the underlying hosting is anonymized by Cloudflare, any takedown attempt must target the domain registration. Continuous re‑evaluation is advised, as the threat actor may shift to alternative IPs or domains within the same registrar footprint.