moonpigsmeme[.]com

This domain is flagged for elevated risk due to generic phishing activity targeting users through fake electronic greeting card (e-card) lures. Analysis indicates the infrastructure was designed to impersonate legitimate e-card platforms, likely to harvest credentials or distribute malware under the guise of personalized messages. The threat type aligns with broad-scale social engineering campaigns rather than targeted brand impersonation, increasing its potential reach to unsuspecting recipients. Infrastructure analysis reveals the domain moonpigsmeme.com was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolved to IP address 172.67.134.91, a Cloudflare-assigned endpoint that may have been used to obfuscate the true hosting origin. At the time of assessment, only 1 of 95 security vendors on VirusTotal flagged the domain, while AlienVault OTX recorded its presence in a single threat intelligence pulse. The domain appeared on one security blocklist and was subsequently taken offline, though its brief operational window suggests a disposable phishing asset. Mitigation steps for this threat type include blocking the domain and its resolving IP at the network perimeter, particularly in environments where e-card notifications are common. Security teams should monitor for inbound emails or messages referencing moonpigsmeme.com, as these may contain malicious links or attachments. User education should emphasize verifying sender authenticity before interacting with e-card notifications, especially those from unfamiliar domains. Given the domain's recent creation date and low detection rates, retrospective analysis of logs for connections to 172.67.134.91 is recommended to identify potential prior exposure.