moonpay-help-desk[.]blogspot[.]com

This domain, moonpay-help-desk.blogspot.com, is flagged as an active brand impersonation threat targeting Facebook users. Infrastructure analysis reveals it is hosted on Blogger infrastructure, resolving to an IPv6 address (2a00:1450:4001:80e::2001) within Google LLC's network (AS15169, Germany). The domain was registered on July 31, 2000, through MarkMonitor, Inc., and uses Google nameservers (ns1-4.google.com), which is consistent with legitimate Blogger-hosted sites but does not preclude malicious use. The page title 'moon' does not match the impersonated brand, suggesting either obfuscation or incomplete site setup. Detected technologies include Java, Python, OpenGSE, Clipboard.js, and HTTP/3, which are not inherently malicious but may facilitate phishing operations. The domain is classified as a social media phishing site, though the exact mechanics of the scam (e.g., credential harvesting, malware distribution) remain unconfirmed due to lack of direct page analysis. Two of 95 security vendors on VirusTotal flag the domain, and it appears on one blocklist (PhishDestroy). The Gridinsoft trust score of 0/100 further indicates high risk. Defenders should treat this domain as malicious, particularly in environments where Facebook-related phishing poses a risk. Blocking at the DNS or network level is recommended, along with monitoring for user interactions with the domain. The use of Blogger infrastructure complicates takedown efforts, as it leverages legitimate hosting services. No evidence suggests compromise of the underlying platform, only abuse of its services.