moonwealth[.]top

Analysis of moonwealth.top reveals a domain flagged as a high-risk phishing threat as of July 27, 2026. The domain was registered on April 3, 2026, through NameSilo, LLC, a registrar sometimes associated with lower-cost domain registrations that can be abused for malicious purposes. It resolves to IP address 198.251.89.168, and its nameservers are ns10.my-control-panel.com and ns9.my-control-panel.com, which are commonly used in hosting setups that may lack robust abuse mitigation. VirusTotal data shows that 16 out of 91 security vendors flag this domain as malicious or suspicious, indicating broad industry recognition of the threat.

Additionally, the domain appears on at least one security blocklist and is specifically blocked by PhishDestroy, a dedicated phishing protection service. The domain remains active at the time of this report, meaning continued risk to users. It is uncertain what exact brand or service the phishing targets, as no page title or scam type details are available for this assessment. Defenders should immediately block access to moonwealth.top on network security appliances, email gateways, and DNS filtering systems.

The active status suggests that threat actors may still be using this domain to host malicious content or distribute phishing links. Organizations should monitor logs for any connections to this domain or attempts to resolve it, and consider adding it to threat intelligence feeds for proactive blocking. Given the high detection rate and active state, this domain poses a clear and present danger to users and should be treated as confirmed phishing infrastructure until further forensic analysis can determine the specific lure or payload.