blockstreet[.]moneys[.]run

Analysis of blockstreet.moneys.run shows a freshly registered domain (created March 07, 2026) that is actively serving a phishing page titled "BlockStreet". The site is hosted behind Cloudflare (nameservers maya.ns.cloudflare.com and amos.ns.cloudflare.com) and resolves to the IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) located in the United States. The web server presents a valid Let's Encrypt certificate (E7) and negotiates HTTP/3, while the page itself is built with Bootstrap and Cloudflare Browser Insights, indicating a modern front‑end stack designed to mimic legitimate services. The HTTP response code is 200, confirming that the page is reachable and delivering content.

Threat intelligence flags the domain as a generic phishing operation. The site has been added to three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal scans show that 2 out of 95 security vendors have flagged the domain, reinforcing the classification despite the low detection ratio. The combination of a brand‑new registration, a zero trust score, and inclusion on multiple blocklists provides concrete evidence that the domain is being used to harvest credentials or financial information under the guise of a legitimate "BlockStreet" service.

Defenders should block resolve-to IP 188.114.96.3 and the associated Cloudflare nameservers, enforce URL filtering for the exact domain, and monitor for any outbound connections to the site. Email gateways should be configured to quarantine messages containing links to blockstreet.moneys.run, and user education campaigns should highlight the fraudulent nature of the "BlockStreet" page. Continuous re‑evaluation of the domain is advised, as the active status and low trust score suggest that the threat actor may modify the payload or launch additional campaigns using the same infrastructure.