moonbag-5gw[.]pages[.]dev

The domain moonbag-5gw.pages.dev has been identified as a high-risk generic phishing site impersonating Moonbag.org, a cryptocurrency project. The threat type is categorized as a crypto drainer, designed to deceive users into providing sensitive information, such as private keys or wallet addresses, which can lead to the unauthorized transfer of funds.

Analysis indicates that moonbag-5gw.pages.dev has a VirusTotal detection score of 13/95, suggesting that it has been flagged by a significant number of security vendors. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.77, which is located in Canada and is associated with Cloudflare's infrastructure. The domain was created on March 25, 2026, and has a Google Trust Services / WE1 SSL certificate. The site appears on 1 security blocklist and is blocked by PhishDestroy. The page title 'Presale is LIVE | Join Now - Moonbag.org · MoonBag | The Cutest Crypto Meme Coin - Presale is Live' is designed to mimic the official Moonbag.org website, further indicating an attempt to deceive users.

The domain is currently active, posing a significant risk to users who may be tricked into interacting with it. Immediate actions include updating security filters to block access to this domain and educating users about the risks of clicking on suspicious links or entering sensitive information on unverified websites. Despite the domain being flagged and blocked by some vendors, it remains accessible to a large number of users, highlighting the need for continuous monitoring and proactive security measures.