app[.]tmoonunion[.]com

Analysis of app.tmoonunion.com shows that the domain was created on 21 February 2026 and is currently reported as offline. VirusTotal logs indicate a single detection out of 95 security vendors, confirming that at least one vendor flagged the domain for malicious activity. The domain appears on one security blocklist and is actively blocked by the PhishDestroy service, reinforcing its classification as a phishing‑related resource.

The threat rating assigned to the domain is elevated, signalling a higher priority for defenders. No additional infrastructure details such as IP address, autonomous system number, hosting provider, SSL certificate metadata, or page title have been disclosed in the available intelligence, leaving those elements unverified. This lack of observable hosting information prevents a deeper infrastructure mapping and limits insight into the threat actor’s operational footprint.

Defenders should maintain the block on app.tmoonunion.com across web gateways, email filters, and DNS security solutions, and ensure the domain remains on internal phishing‑prevention lists. Monitoring for any re‑registration attempts or new activity associated with the domain is advisable, as the prior detection suggests it was employed in a phishing campaign. Although the site is offline, the elevated risk level and blocklist presence warrant continued vigilance and periodic review of related threat intel feeds.