moonbirds[.]pages[.]dev

Analysis indicates that the domain moonbirds.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. The authoritative nameservers listed are abby.ns.cloudflare.com and huxley.ns.cloudflare.com, and the domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented a page title of "Suspected phishing site | Cloudflare" and returned an HTTP 403 status code at the time of observation, suggesting that access was blocked or the content was removed. The TLS certificate was issued by Google Trust Services under the WE1 certificate authority, confirming that HTTPS was correctly provisioned. Security telemetry shows that 12 of 95 VirusTotal scanners flagged the domain, and Google Safe Browsing has labeled it as a social engineering threat.

The domain appears on three security blocklists, specifically PhishDestroy, MetaMask, and SEAL, and is noted on three additional blocklists in aggregated intelligence sources. A Gridinsoft trust score of 0 out of 100 further reflects a high confidence in malicious intent. The observed scam type is credential phishing, and the risk level has been assigned as high. The current operational status is offline, indicating that the site has been taken down or is no longer serving content.

Defenders should continue to block the domain at perimeter devices, update DNS‑based blacklists, and monitor the associated IP address for any re‑use in future campaigns. Continuous re‑scanning with VirusTotal and periodic checks against Google Safe Browsing are recommended to detect any resurgence. Organizations should also consider enforcing strict email authentication and user awareness training to mitigate credential harvesting attempts that may be linked to this infrastructure.