acc-muopey-apps[.]wixstudio[.]com

This domain, acc-muopey-apps.wixstudio.com, is confirmed to operate as a crypto credential theft platform specifically designed to impersonate MoonPay, a legitimate cryptocurrency payment processor. Analysis indicates the site employs brand impersonation tactics to deceive users into submitting wallet credentials or private keys, likely facilitating unauthorized access to cryptocurrency holdings. The page title, 'Login | MoonPay®® — Sign In,' directly mimics MoonPay’s official branding, reinforcing the fraudulent intent. No explicit drainer kit signatures were detected in the initial scan, but the infrastructure aligns with credential harvesting frameworks commonly used in crypto-related fraud schemes. Technical indicators reveal multiple high-confidence red flags. The domain is flagged by 6 out of 95 security vendors on VirusTotal, with active blocklisting across 5 threat intelligence feeds, including MetaMask and PhishingArmy. It was registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The domain’s SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. Detection technologies include Wix as the primary hosting platform, alongside React, Lodash, and Google Cloud CDN, suggesting a modern, cloud-based deployment. The domain is also listed in Google Safe Browsing (GSB) databases, further corroborating its malicious classification. No creation date was provided in the initial data, but the use of Wix Studio subdomains often correlates with rapid, low-effort deployment typical of phishing campaigns. As of the latest assessment, the domain has been taken offline, likely in response to blocklist enforcement and security vendor detections. However, residual risk persists due to the potential for rapid redeployment under a new subdomain or domain structure. Users who interacted with the site should immediately revoke any active sessions, rotate credentials, and monitor associated cryptocurrency wallets for unauthorized transactions. Organizations should update internal blocklists to include the resolved IP (34.144.206.118) and related subdomains under the wixstudio.com namespace. Given the domain’s prior use of Google Cloud infrastructure, security teams are advised to monitor for similar patterns in other cloud-hosted subdomains, particularly those leveraging Wix or comparable website builders for rapid deployment. Proactive threat hunting should focus on domains impersonating crypto payment processors, as this remains a high-value target for credential theft operations.