account-minecraft[.]net

This domain, account-minecraft.net, was registered on July 15, 2026, through Fewmoretaps OU operating as Trustname.com. Analysis indicates it is actively serving credential phishing pages targeting users of the Minecraft gaming platform. The domain is currently resolving to IP address 104.21.24.181 and utilizes Cloudflare nameservers (dara.ns.cloudflare.com and vicky.ns.cloudflare.com), a common pattern observed in phishing infrastructure to obscure hosting origins and evade takedowns. As of the report date, the domain appears on one security blocklist and is explicitly blocked by PhishDestroy, confirming its classification as a high-risk credential theft operation. VirusTotal data shows a single detection from 95 security vendors, suggesting limited but present recognition of the threat. The domain remains active, with no evidence of suspension or deactivation by the registrar or hosting provider. Defenders should treat this domain as a confirmed phishing asset and implement immediate blocking at the DNS, network, and endpoint levels. Additional monitoring of related Cloudflare-hosted domains and newly registered domains under the same registrar may help identify further malicious infrastructure linked to this campaign. The exact content and targeting mechanisms of the phishing pages are not yet fully analyzed, but the domain's name and early detection signals strongly align with credential harvesting tactics.