moontax[.]ai-cryptolist[.]com

The domain moontax.ai-cryptolist.com was registered on April 11, 2026 through Key-Systems GmbH and quickly appeared on a security blocklist maintained by PhishDestroy. VirusTotal records show a single detection out of 95 scanned security vendors, and Gridinsoft assigns a trust score of 0 out of 100, indicating an extremely low confidence in the site's legitimacy. The site returns an HTTP 302 redirect and presents a page titled CRYPTOLIST, matching the branding used in known phishing campaigns that target cryptocurrency users.\n\nInfrastructure analysis reveals that the domain resolves to Cloudflare nameservers aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com, leveraging Cloudflare’s CDN and HTTP/3 support. The front‑end stack includes Vue.js and an IPFS component, a combination that has been observed in recent phishing kits designed to host dynamically generated lure pages while evading static content detection. The presence of IPFS suggests that the malicious payload may be distributed across a decentralized network, complicating takedown efforts.\n\nWhile the available intelligence confirms the domain’s active status and its association with a generic_phishing campaign, details such as the specific phishing lure, target audience, or any credential‑harvesting endpoints remain unknown. Defenders should prioritize blocking DNS resolution for moontax.ai-cryptolist.com and its associated Cloudflare nameservers, monitor for HTTP 302 redirects to similar hostnames, and add the domain to internal blocklists. Continuous scanning of related IPFS hashes and observation of Vue.js scripts may uncover additional indicators of compromise, enabling faster remediation of downstream threats.