luna-app-9at[.]pages[.]dev

This domain, luna-app-9at.pages.dev, is currently under investigation for generic phishing activity, specifically targeting cryptocurrency users. Analysis indicates no direct association with a known brand or drainer kit at this stage, though the infrastructure aligns with common phishing deployment patterns. The domain lacks identifiable legitimate business use and exhibits characteristics consistent with credential harvesting or wallet-draining schemes. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 27, 2026, through Cloudflare Pages, a platform frequently leveraged for rapid phishing site deployment due to its ease of use and free hosting capabilities. VirusTotal reports 0 out of 95 security vendors flagging the domain as malicious, suggesting it has not yet been widely detected or analyzed. The domain resolves to Cloudflare IP ranges, which are often used to obfuscate the true origin of malicious infrastructure. As of the latest assessment, it appears on one security blocklist, and Google Safe Browsing (GSB) has not yet flagged it as unsafe. The domain remains active and accessible, with no takedown or mitigation measures observed. While the lack of detections on VirusTotal may indicate a low immediate threat profile, the presence on a security blocklist and the domain's creation date—projected into the future—suggests potential preemptive registration for malicious use. Users are advised to exercise caution, avoid interacting with the domain, and treat any associated links or communications as high-risk. Organizations should monitor for further detections and consider proactive blocking based on the existing blocklist inclusion.