moonpayaccounts[.]blogspot[.]com

Analysis of moonpayaccounts.blogspot.com indicates that the sub‑domain was used for a credential‑phishing campaign targeting users of the MoonPay service. The site returned HTTP 404 at the time of observation, and the hosting provider has taken it offline, which aligns with the “taken offline” status in the intelligence feed. The domain resolves to 64.233.180.132, an IP address owned by Google LLC (AS15169) and located in the United States. The certificate presented is issued by Google Trust Services under the WE2 series, meaning the TLS connection is cryptographically valid and would appear trustworthy to browsers. The page title “MoonPay Accounts” was retrieved, confirming the intent to impersonate the legitimate MoonPay brand.

VirusTotal records show that two of ninety‑three scanning engines flagged the domain, providing additional independent corroboration of malicious intent. The domain appears on one public security blocklist and is listed as blocked by PhishDestroy, further evidencing its classification as a phishing resource. Technical fingerprints reveal the use of Blogger as the content management system, with ancillary technologies including Java, Python, OpenGSE, and support for HTTP/3, all typical of Google‑hosted blog sites. Registration data shows the domain was created on 31 July 2000 and is managed through MarkMonitor, Inc., a registrar commonly used by high‑value brands, which may have been leveraged to add legitimacy.

Nameservers ns1‑ns4.google.com confirm that the sub‑domain inherits Google’s DNS infrastructure. While the site is currently inaccessible, the combination of a brand‑specific page title, active blocklisting, and detections by multiple security vendors indicates a credible credential‑phishing threat. Defenders should continue to block the domain at the DNS or proxy layer, monitor for any re‑registration attempts, and include the associated IP address in threat‑intel feeds.