moonreels[.]one

This domain, moonreels.one, is currently flagged as a generic phishing threat and is under active investigation as of August 06, 2026. The domain remains active and resolves to IP address 172.67.158.196, which is associated with Cloudflare infrastructure, as indicated by its nameservers gwen.ns.cloudflare.com and kip.ns.cloudflare.com. The domain is listed on one security blocklist and is blocked by the PhishDestroy service, confirming that at least one independent security source has identified it as a potential threat.

VirusTotal has scanned the domain with 91 vendors, and none currently flag it as malicious. This absence of detections should not be interpreted as proof that the domain is safe, as phishing domains often evade detection until they are actively used in campaigns. The low blocklist presence and lack of vendor flags may indicate that the domain is either newly registered, not yet widely distributed, or cleverly disguised.

The exact nature of the phishing campaign remains unclear. The domain is classified as generic phishing, but no specific brand, page title, or scam kit has been identified in the available intelligence. Analysts have not yet been able to view the live content of the site, so the precise lure or impersonated service is unknown. This lack of detail is common in early-stage investigations, and further analysis is required to determine the targeting strategy.

Defenders should treat moonreels.one as a potential threat and monitor any traffic to it. Organizations should block the domain at the DNS and proxy levels, and users should be warned against clicking links from unknown sources that direct to this domain. Given the domain's active status and Cloudflare hosting, which can obscure the origin server, investigators should continue to monitor for changes in DNS records, SSL certificate issuance, and any updates to the page content.