moonbirdses[.]xyz

Analysis as of July 24 2026 indicates that the domain moonbirdses.xyz is actively being used for a phishing campaign. The site returns an HTTP 403 response and presents a page titled “Just a moment…”, which is commonly employed by Cloudflare‑protected pages to delay automated analysis. Infrastructure inspection shows the domain resolves to 172.67.180.46, an address owned by Cloudflare, Inc. (ASN 13335) located in the United States. The domain is served behind Cloudflare’s edge network, as evidenced by the presence of Cloudflare Browser Insights and support for HTTP/3, and uses a certificate issued by Google Trust Services under the WE1 designation. Registration records reveal the domain was created on February 21 2026 through NiceNIC International Group Co., Limited, and the authoritative nameservers are meilani.ns.cloudflare.com and nolan.ns.cloudflare.com.

Reputation data demonstrates that eight of ninety‑five VirusTotal scanners have flagged the domain, and it appears on four external blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The Gridinsoft trust score of 0 out of 100 further reinforces the malicious assessment. Despite the relatively recent registration date, the combination of a low trust score, multiple blocklist listings, and detection by several security vendors establishes a high risk rating.

Open questions remain regarding the exact payload delivered after the initial Cloudflare challenge page, as no content beyond the title has been captured. Analysts cannot confirm the specific credential‑stealing vectors or target brands without further page inspection. Consequently, defenders should block or sandbox any traffic to moonbirdses.xyz, monitor DNS queries for the domain, and update intrusion‑detection signatures to include the observed IP address and Cloudflare nameserver pattern.