moonblrds[.]ngrok[.]io

The domain moonblrds.ngrok.io was identified as a generic phishing site posing an elevated risk. It did not impersonate a specific brand or deploy a known drainer kit but presented itself under the title 'Moonbirds Minting', likely targeting users with fraudulent minting or login schemes. As of the latest verification, moonblrds.ngrok.io has been taken offline, though it previously exhibited active phishing behavior.

Technical analysis shows that moonblrds.ngrok.io was flagged by 1 of 95 security vendors on VirusTotal, including Gridinsoft, and appeared on 3 security blocklists (PhishDestroy, MetaMask, and SEAL). The domain was registered through NameCheap, Inc. on February 21, 2026, and resolved to the IP address 18.158.249.75, hosted on Amazon.com, Inc. infrastructure in Germany (AS16509). Its SSL certificate was issued by Let's Encrypt (E7), and the observed HTTP status was 404. Nameservers associated with the domain included ns-146.awsdns-18.com, ns-1482.awsdns-57.org, ns-1654.awsdns-14.co.uk, and ns-886.awsdns.

Users who interacted with moonblrds.ngrok.io should take immediate action to secure their accounts. For credential-based phishing, change passwords on any site where the same credentials may have been reused, enable two-factor authentication (2FA), and monitor accounts for unauthorized activity. If financial or crypto-related details were entered, revoke any token approvals and consider transferring funds to a new wallet. Report the domain to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to assist in broader mitigation efforts.