verify-moonpay[.]com

Analysis of verify-moonpay.com shows an active credential‑phishing infrastructure targeting users of the MoonPay brand. The domain was registered on July 10 2026 through Ultahost, Inc., and resolves to the Cloudflare‑hosted address 172.67.210.195. HTTP requests return a 200 status code and the page title “Important Security Update – MoonPay” is served, indicating an attempt to masquerade as an official security notice. The domain is delegated to the Cloudflare nameservers adelaide.ns.cloudflare.com and algin.ns.cloudflare.com, a common pattern for fast‑flux or CDN‑based phishing sites. VirusTotal analysis recorded three positive detections out of 91 scanned security vendors, reinforcing the malicious classification. While the exact content of the landing page has not been captured, the combination of recent registration, brand‑specific title, and positive threat intelligence points to a high‑risk credential‑phishing campaign. Defenders should block DNS resolution for verify-moonpay.com, monitor outbound traffic for connections to 172.67.210.195, and update email and web filters to flag communications referencing the “Important Security Update – MoonPay” phrasing. Continued observation is advised to capture any payloads or credential‑harvesting forms that may be deployed.