moonpayt[.]com

The domain moonpayt.com has been identified as a brand impersonation threat targeting Gmail, a widely used email service. Analysis indicates the domain is currently offline, though it previously hosted content mimicking the Google login interface, as evidenced by its page title labeled 'Google.' This activity aligns with phishing campaigns designed to harvest user credentials by presenting fraudulent authentication portals. Infrastructure analysis reveals the domain was registered on October 15, 2025, through ABOVE.COM PTY LTD. It resolved to the IPv6 address 2607:f8b0:4004:c09::68 and utilized a Let's Encrypt SSL certificate issued under the R13 intermediate. Detection metrics show the domain was flagged by 10 of 95 security vendors on VirusTotal, while appearing on one security blocklist. Additionally, the domain was documented in a single threat intelligence pulse on AlienVault OTX, further corroborating its malicious classification. Given the domain's current offline status, immediate interaction risks are mitigated. However, organizations and users are advised to treat any prior or future communications referencing moonpayt.com as malicious. Network administrators should update blocklists to include this domain and its associated indicators, while end-users should verify the legitimacy of any login portals before entering credentials. Monitoring for similar domains registered through the same registrar may aid in preempting related threats.