lunarug[.]com

Analysis of the domain lunarug.com indicates it is an active phishing site targeting users through a scheme labeled 'Luna Launch,' as evidenced by the page title. Registered on May 25, 2026, through HOSTINGER operations, UAB, the domain remains operational with a stable HTTP 200 status, suggesting ongoing malicious activity. Infrastructure analysis reveals the domain is hosted behind Cloudflare nameservers (jill.ns.cloudflare.com and noel.ns.cloudflare.com) and resolves to the IP address 188.114.97.3, located in Canada under Cloudflare, Inc. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, providing no definitive indication of intent. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which classify it as malicious. Gridinsoft assigns a trust score of 0/100, further supporting its classification as high-risk. While VirusTotal shows only one of 91 security vendors flagging the domain, this limited detection does not diminish the broader evidence of malicious intent, particularly given the domain's inclusion on specialized blocklists targeting phishing and crypto-related threats. The exact nature of the phishing scheme remains uncertain due to the lack of detailed content analysis, but the 'Luna Launch' title suggests a potential focus on cryptocurrency users, possibly mimicking a legitimate project or token launch. Defenders should treat this domain as an active threat, blocking access at the network and endpoint levels. Organizations should also monitor for any internal traffic to lunarug.com and investigate potential exposure or credential compromise. Given the domain's recent registration and continued activity, further monitoring is recommended to track any shifts in infrastructure or targeting behavior.