moonslogin[.]top

This domain, moonslogin.top, is specifically flagged for credential phishing, a high-risk threat where attackers attempt to steal user credentials through deceptive means. The domain has been identified as a potential source of phishing attacks, leveraging its resemblance to legitimate login pages to trick users into divulging sensitive information such as usernames, passwords, and private keys.

Analysis indicates that moonslogin.top has been flagged by 10 out of 95 security vendors on VirusTotal, suggesting a moderate level of consensus among security experts regarding its malicious nature. The domain is registered through Global Domain Group LLC and was created on June 17, 2026, which is a relatively recent date, often indicative of newly established phishing campaigns. Additionally, the domain appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and OISD, further corroborating its involvement in credential phishing activities. The domain currently resolves to the IP address 188.114.96.3, which has been taken offline, potentially as a result of security actions or the attacker's decision to abandon the site.

If users have visited moonslogin.top, they are advised to immediately change their login credentials for any accounts that may have been compromised, especially those related to financial or sensitive data. It is also recommended to enable two-factor authentication (2FA) for all critical accounts to add an additional layer of security. Users should monitor their accounts for any unauthorized activity and report any suspicious incidents to their respective service providers. Furthermore, users should be cautious of similar-looking domains and verify the authenticity of login pages before entering any credentials.