lunartools[.]cc

Analysis of lunartools.cc, first observed on August 04, 2026, indicates active malicious use. The domain was registered through Spaceship, Inc., and resolves to the IPv4 address 216.150.16.1. VirusTotal scans show that 2 of 91 security vendors have flagged the domain, suggesting at least limited detection by automated tools.

Independent blocklist monitoring confirms the domain’s presence on three separate security blocklists, and it is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services. These indicators collectively point to a credential harvesting operation, although the specific brand or service being impersonated has not been disclosed in the available intelligence. The rapid creation date, combined with immediate blocklist inclusion, implies a short‑lived infrastructure designed for quick exploitation.

Current evidence does not provide details on page content, SSL configuration, HTTP response codes, or any observed phishing kit, leaving the exact attack vector uncertain. Defenders should add lunartools.cc to internal blocklists, monitor DNS queries for the 216.150.16.1 address, and enforce outbound filtering that includes the listed blocklist providers. Continuous re‑scanning on platforms such as VirusTotal is recommended to capture any future vendor detections, and any observed traffic to the domain should be treated as malicious and investigated for potential credential compromise.