lunarconnection[.]cfd

This domain is flagged as an elevated-risk credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. Analysis indicates the infrastructure was specifically engineered for short-term, high-impact fraud campaigns, leveraging social engineering tactics to mimic legitimate services. Infrastructure analysis reveals the following technical indicators: the domain lunarconnection.cfd was registered on March 29, 2026, through Global Domain Group LLC, an entity frequently associated with transient phishing operations. It resolves to the IP address 91.92.34.18, a host with a documented history of malicious activity. The SSL certificate is issued by Let's Encrypt, a common choice for threat actors due to its low-cost, automated issuance process. The domain appears on one security blocklist and is actively blocked by enterprise-grade threat intelligence systems. VirusTotal detection metrics show 4 out of 95 security vendors flagging the domain as malicious, a relatively low but still significant detection rate that suggests targeted or evasive techniques. Mitigation against credential harvesting threats posed by this domain requires a multi-layered approach. Network-level protections should include immediate blocking of the IP address 91.92.34.18 and domain lunarconnection.cfd at firewalls and DNS resolvers. Endpoint security solutions should be configured to detect and prevent access to newly registered domains, particularly those with creation dates within the last 90 days. User awareness training should emphasize the risks of entering credentials on unfamiliar sites, even those with valid SSL certificates. Security teams are advised to monitor for credential reuse attempts across corporate systems, as harvested credentials are often exploited within hours of collection. Post-incident review should include log analysis for any prior connections to the domain or IP to assess potential compromise.