secure--sso--moonapy---auth[.]webflow[.]io

The domain secure--sso--moonapy---auth.webflow.io is a credential phishing site designed to harvest login credentials from victims. It does not impersonate a specific brand or use a known drainer kit. As of the latest verification, the site has been taken offline, but it previously posed an elevated risk of credential theft through deceptive login prompts.

Technical indicators confirm the domain was flagged by 2 of 95 VirusTotal security vendors, including ChainPatrol and alphaMountain.ai. It appears on one security blocklist, PhishDestroy, but was not flagged by Google Safe Browsing. The domain was registered through MarkMonitor, Inc. on May 08, 2013, and resolves to the IP address 104.18.36.248, hosted on Cloudflare's infrastructure (AS13335). The SSL certificate is issued by Google Trust Services / WE1, and the observed page title was '404 - Page not found' with an HTTP 404 status. Technologies detected include Cloudflare and HTTP/3, with nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com.

Victims of credential phishing via secure--sso--moonapy---auth.webflow.io should immediately change passwords for any accounts accessed through the site, particularly if the same credentials were reused elsewhere. Enable two-factor authentication (2FA) on all critical accounts to prevent unauthorized access. Monitor accounts for signs of fraud, such as unauthorized transactions or login attempts. Report the phishing domain to the Federal Trade Commission (FTC) at reportfraud.ftc.gov, to Google Safe Browsing via their reporting tool, and to the Anti-Phishing Working Group (APWG) at reportphishing@apwg.org.