xn--moonsho-trb[.]com

The domain xn--moonsho-trb.com was registered on February 21, 2026 through Tucows Domains Inc. and is currently taken offline, returning HTTP 403 for all requests. DNS resolution points to 142.251.40.228, an address owned by AS15169 Google LLC in the United States. The authoritative name servers are agustin.ns.cloudflare.com and lady.ns.cloudflare.com, indicating Cloudflare is used as a CDN and DNS provider. The site presented a TLS certificate issued by Let’s Encrypt (certificate version E7), which is typical for short‑lived malicious infrastructure.

VirusTotal analysis shows that four of ninety‑three scanning engines flagged the domain as malicious, and the domain appears on two external blocklists, including PhishDestroy and ScamSniffer. The page title returned by the server is “Google”, matching the brand target “gmail” and the declared scam type of brand impersonation. Technologies observed include Cloudflare and HTTP/3, suggesting the attacker leveraged modern protocol support to improve performance or evade detection. Evidence confirms that the domain is being used to impersonate Google’s Gmail service, but the exact payload, landing page content, or credential‑harvesting mechanisms have not been publicly disclosed.

The offline status and 403 response limit immediate observation of malicious content, leaving the precise user‑facing experience unknown. Defenders should add xn--moonsho-trb.com to URL filtering and DNS block policies, monitor for re‑registration of the punycode label or similar homograph variants, and watch for any future activity originating from the same IP address or Cloudflare name servers. Continuous review of threat‑intelligence feeds for updates to the blocklist status and any new detection signatures is recommended.