opgmoneyhoneyponey[.]lol

The domain opgmoneyhoneyponey.lol was registered on March 22 2026 through PublicDomainRegistry.com (operated by PDR Ltd.) and is currently listed as offline. DNS resolution points to 188.114.96.3, an address owned by Cloudflare, Inc. in Canada, and the domain is served by Cloudflare nameservers ezra.ns.cloudflare.com and jocelyn.ns.cloudflare.com. No TLS certificate is presented, indicating that HTTPS connections are not established. The only observable HTTP response contains the title “Just a moment…”, which provides no functional content and is typical of placeholder pages used during content delivery or redirection. Infrastructure analysis shows the site leverages Cloudflare services, including Browser Insights and HTTP/3, which are commonly used for performance acceleration and do not imply benign intent.

The domain appears on three public blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and the SEAL blocklist, reinforcing the assessment that it is being used for malicious activity. VirusTotal scans report that three out of ninety‑four security vendors flagged the domain, further indicating suspicious behavior. The known intelligence categorises the activity as an investment‑scam type of generic phishing, suggesting that the domain may have been used to lure victims with promises of financial returns. However, because the site is offline and the page content has not been captured, the exact tactics, credential‑stealing forms, or lure mechanisms remain unknown.

No evidence of a valid SSL certificate, malicious payloads, or specific phishing kits was observed in the available data. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection of the host in future DNS queries, and include the associated IP address in threat‑intel feeds. Periodic rescanning of the domain when it becomes reachable is advised to capture any changes in payload or hosting.