moriarty-sites[.]com

Analysis of moriarty-sites.com as of July 24, 2026 shows a newly registered domain created on July 19, 2026 and currently active. The domain is registered through Fewmoretaps OU doing business as Trustname.com and is delegated to Cloudflare nameservers elma.ns.cloudflare.com and jihoon.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which is consistent with Cloudflare‑owned hosting infrastructure. VirusTotal records indicate that the domain has been scanned by 91 antivirus and URL‑reputation vendors, none of which returned a detection at the time of the scan.

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, suggesting that at least one security organization has identified malicious activity associated with the host. No publicly available page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact content of the site unverified. The limited evidence points to a typical generic phishing infrastructure: rapid registration, use of a reputable CDN for anonymity, and inclusion on a blocklist.

However, the absence of additional telemetry such as payload samples, credential‑harvesting forms, or observed victim reports creates uncertainty regarding the scale and specific targets of the campaign. Defenders should treat moriarty-sites.com as a high‑confidence malicious indicator, enforce blocklisting at network perimeter, monitor DNS queries for the domain, and consider adding the IP 188.114.96.3 to deny‑list rules. Continuous re‑evaluation is advised as new telemetry emerges, particularly any changes in detection status from sandbox or URL‑reputation services.