self-service[.]moontoncs[.]com

PhishDestroy identifies self-service.moontoncs.com as an active credential theft scam posing as a legitimate self-service portal. This domain, registered through Squarespace Domains II LLC on December 05, 2025, has already drawn attention from 6 of 95 VirusTotal security vendors, indicating elevated risk. The domain resolves to IP 64.29.17.1 and uses a Let's Encrypt SSL certificate, which may lend false credibility to potential victims.

This domain leverages a self-service themed name to trick users into entering login credentials or other sensitive information under the guise of a legitimate service. Threat actors often abuse recently registered domains like this one—created just days ago—to capitalize on the trust gap before security measures catch up. The low but nonzero detection rate on VirusTotal suggests this domain is still in early circulation, making it critical for users to exercise caution before interacting with any links or forms hosted on self-service.moontoncs.com.

Users who visited this domain should immediately check for unauthorized access to any accounts, especially those tied to the credentials entered. If any suspicious activity is detected, reset passwords immediately and enable multi-factor authentication where available. Avoid downloading any files or entering personal information on this site. Report the domain to your security team or via PhishDestroy’s threat intel portal to help block further abuse. Organizations should consider blocking this domain at the network level to prevent additional exposure.