moonslogin[.]help

The domain moonslogin.help, now offline, was used for credential phishing, targeting unsuspecting users with deceptive login prompts. Despite being flagged by 9 out of 91 vendors on VirusTotal, the site managed to operate briefly before being taken down. It was also listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, indicating its malicious intent.

Registered through Global Domain Group LLC and hosted on an IP managed by Cloudflare, Inc., the domain utilized an SSL certificate issued by Google Trust Services. This setup might have lent an air of legitimacy to the site, potentially misleading victims into entering sensitive information. The domain was created on June 17, 2026, and detected by PhishDestroy just two days later, highlighting the rapid identification and response to emerging threats.

The swift takedown of moonslogin.help underscores the effectiveness of monitoring systems in identifying and neutralizing phishing threats. The platform risk score of 80 out of 100 further emphasizes the significant risk posed by this domain. As phishing tactics become increasingly sophisticated, the ability to detect and block such threats promptly is crucial in safeguarding user information.