moriarty-vhod-market[.]com

Analysis of the domain moriarty-vhod-market.com indicates a credential harvesting phishing infrastructure registered on July 19, 2026, through Fewmoretaps OU d/b/a Trustname.com. The domain remains active as of July 30, 2026, and resolves to IP address 188.114.97.3, hosted on Cloudflare nameservers igor.ns.cloudflare.com and jean.ns.cloudflare.com. While VirusTotal scans from 91 security vendors returned no detections, this absence does not confirm safety, as phishing domains often evade initial detection. The domain appears on one security blocklist, suggesting early-stage identification by at least one threat intelligence source.

Infrastructure analysis reveals Cloudflare hosting, a common tactic to obscure origin servers and evade IP-based blocking. The registrar, Trustname.com, has been associated with previous phishing campaigns, though no direct attribution links this domain to prior incidents. No SSL certificate details, HTTP response codes, or page content analysis are currently available, limiting assessment of the site's operational status or specific targeting.

Defenders should treat this domain as high-risk for credential theft, particularly given its recent registration and active resolution. Recommended actions include blocking the domain and IP at perimeter controls, monitoring for connections from internal assets, and submitting samples to threat intelligence platforms for broader detection coverage. Further investigation is required to determine the exact brand or service being impersonated, as no specific target is identified in available data.