sell[.]moonpay-staging[.]com

Analysis of the domain sell.moonpay-staging.com confirms its classification as a high-risk phishing site targeting users of the MoonPay cryptocurrency platform. Registered on March 11, 2026, through Cloudflare, Inc., this domain presents itself with the page title 'MoonPay,' directly mimicking the legitimate service. The site remains active as of July 12, 2026, and resolves to the IP address 104.18.5.205, a Cloudflare-hosted endpoint. Infrastructure analysis reveals the use of Google Cloud, Vercel, and Cloudflare technologies, alongside HSTS and Google Cloud CDN, suggesting an attempt to appear technically legitimate while leveraging widely trusted cloud services. The domain is flagged by multiple security sources, including two blocklists and four out of ninety-five security vendors on VirusTotal, which classify it as malicious. Its SSL certificate, issued by Google Trust Services, further aligns with common phishing tactics that exploit valid encryption to evade initial scrutiny. The Gridinsoft trust score of 0/100 reinforces the assessment of malicious intent, though the exact payload or phishing kit in use remains unconfirmed. The presence of Google Pay and LaunchDarkly in detected technologies may indicate an effort to replicate payment-related workflows, a frequent tactic in cryptocurrency phishing schemes. Defenders should treat this domain as an active threat. The combination of a recently registered domain, direct impersonation of a well-known brand, and reliance on reputable cloud infrastructure is consistent with credential harvesting or fraudulent transaction schemes. Network-level blocking of 104.18.5.205 and the domain itself is recommended, alongside monitoring for related subdomains or IP shifts. While the specific victim count or targeted regions are unknown, the domain's continued operation and blocklist presence suggest ongoing risk. Further investigation into associated infrastructure may uncover additional linked phishing assets.