gmoonline[.]top

On 24 July 2026 analysis of the domain gmoonline.top shows that the site was registered on 24 July 2024 through Gname.com Pte. Ltd. and is hosted at IP address 103.199.102.11, which belongs to ASN138415 (Yancy Limited) located in Hong Kong. The server responded with HTTP 503 at the time of collection and the front‑end was identified as employing Cloudflare with HTTP/3 support. DNS resolution uses the authoritative nameservers a.share-dns.com and b.share-dns.net. The TLS certificate presented is issued by Google Trust Services under the WE1 label, indicating a valid SSL chain.

The page title returned by the HTTP response is “GMOONLINE”, but no further content has been captured because the host is currently taken offline. Reputation services have flagged the domain: one of ninety‑five VirusTotal scanners reported a detection, Gridinsoft assigned a trust score of 0 / 100, and the domain appears on two independent blocklists, specifically PhishDestroy and Enkrypt. The site is categorized as generic phishing in the threat taxonomy. The combination of a recent registration, low‑reputation hosting in Hong Kong, a valid Google‑issued certificate, and active blocklist listings supports the conclusion that gmoonline.top was used for phishing and has been deliberately taken offline.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanism because the content was not captured before shutdown. Defensive operators should continue to block the domain at the DNS and proxy layers, monitor for any resurgence of the same IP or shared‑dns name servers, and include the associated IP address 103.199.102.11 in threat‑intel feeds. Additional investigation of the hosting provider Yancy Limited may reveal related infrastructure used in other campaigns. The evidence presented thus justifies maintaining the elevated risk rating until the infrastructure is fully retired.