ausmoonpay[.]com

The domain ausmoonpay.com was identified as a brand impersonation threat specifically targeting the Near blockchain ecosystem. This site attempts to deceive users by masquerading as a legitimate service associated with Near, potentially aiming to steal sensitive information such as login credentials or private keys. The page title "月亮湾国际博彩" suggests a gambling theme, which may be used to lure victims into a false sense of security. Such impersonation sites are a common vector for cryptocurrency theft and fraud.

This investigation was supported by multiple data sources. VirusTotal flagged the domain with 2 out of 95 security vendors detecting malicious activity, indicating moderate but concerning community awareness. The domain was created on June 18, 2025, and registered through Gname.com Pte. Ltd., a registrar often associated with low-quality or suspicious domains. It resolves to the IP address 188.114.97.3 and uses an SSL certificate issued by Google Trust Services (WE1), which adds a veneer of legitimacy but does not guarantee safety. The site currently appears on one security blocklist and has been taken offline, though users should remain vigilant as similar domains may appear.

If you have visited ausmoonpay.com or interacted with its content, take immediate precautions. Change any passwords or recovery phrases that may have been entered on the site, especially those related to Near wallets or accounts. Enable two-factor authentication on all cryptocurrency accounts and monitor for unauthorized transactions. Consider running a full security scan on your device using reputable antivirus software. Report any suspected phishing attempts to the relevant blockchain platform or cybersecurity authorities. Staying cautious and verifying URLs before sharing sensitive information is crucial to avoid future threats.