moxwin[.]top

The domain moxwin.top was registered on 21 February 2026 and is currently listed as offline. DNS resolution points to 104.21.64.1, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The sole blocklist entry originates from PhishDestroy, which categorises the site as a phishing resource.

The TLS certificate presented is identified as WE1, offering only basic validation and no extended validation features. A passive scan on VirusTotal recorded three positive detections out of ninety‑one antivirus and URL‑reputation engines, confirming malicious intent despite the low overall detection rate. The only visible page element captured by automated crawlers is the title “Nur einen Moment…”, which does not disclose any legitimate brand or service and is consistent with a placeholder often used by fraudulent landing pages.

No additional intelligence such as Safe Browsing, OTX, or registrar reputation is available, leaving the broader threat actor infrastructure uncharacterised. Given the confirmed blocklist entry, the positive VirusTotal detections, and the association with a Cloudflare edge node, defenders should add moxwin.top to deny‑list rules, enforce DNS‑level blocking, and monitor the hosting IP for collateral activity. Continuous re‑evaluation is advised in case the domain becomes active again or additional indicators emerge from threat‑intel feeds.