moon[.]domdom[.]life

Analysis of moon.domdom.life shows a recently registered domain (creation date May 12 2026) hosted behind Cloudflare’s network (IP 104.21.64.91, CA location). The site presents a valid Let's Encrypt certificate (E7) but returns HTTP 526, indicating an SSL handshake issue likely caused by misconfiguration or deliberate obstruction. The only visible page title is “404 — Page Not Found,” suggesting the landing page is either removed or never served. Infrastructure details include Cloudflare nameservers bradley.ns.cloudflare.com and zariyah.ns.cloudflare.com, and the domain is listed on a single security blocklist, currently blocked by PhishDestroy. Independent scoring (Gridinsoft) rates the domain at 0 / 100, reflecting a high‑risk perception despite the absence of detections from any scanning engines. No evidence of malicious payloads, brand impersonation, or credential‑harvesting pages has been gathered, and the page content has not been captured. Given the generic phishing classification, the domain’s short lifespan, and its active status, defenders should add the domain to outbound filtering rules, monitor DNS queries for related resolutions, and consider sinkholing the IP address to disrupt potential traffic. Continuous re‑evaluation is advised as further intelligence becomes available.