moonpayaccount01[.]blogspot[.]com

The domain moonpayaccount01.blogspot.com was registered on February 21, 2026 and is hosted on Google’s infrastructure (nameserver blogspot.l.googleusercontent.com, IP 142.250.31.132, AS15169, United States). The site presents a TLS certificate issued by Google Trust Services (WE2). A page titled "Buy Verified MoonPay Account" was observed, and the site runs Blogger with supplemental Java, Python, OpenGSE, Clipboard.js and HTTP/3 components. Infrastructure analysis shows a gridinsoft trust score of 0/100 and the domain appears on three security blocklists; it is actively blocked by PhishDestroy, MetaMask and SEAL. VirusTotal scans report two detections out of 93 vendors. The domain is classified as a credential‑phishing operation and is currently active with a high risk rating. No additional content has been examined beyond the page title, so the exact phishing mechanism (e.g., credential‑capture form) remains unverified. Defenders should immediately block the domain at DNS and proxy layers, add it to internal blocklists, and monitor for other blogspot subdomains that follow the same naming pattern. Continuous threat‑intel feeds should be queried for any new indicators related to this host, and any traffic to the IP 142.250.31.132 that originates from internal users should be inspected for anomalous credential‑submission activity.