sso--moonpay-login---m--auth[.]mystrikingly[.]co

This domain, sso--moonpay-login---m--auth.mystrikingly.co, is flagged as an active credential phishing site targeting users through a subdomain hosted on Mystrikingly. Registered on July 13, 2025, via Spaceship, Inc., the domain remains operational as of July 21, 2026, resolving to IP address 103.224.182.244. Infrastructure analysis reveals nameservers linked to AboveDomains (581.ns1.abovedomains.com, 581.ns2.abovedomains.com, ns1.abovedomains.com, ns2.abovedomains.com), a provider frequently associated with low-reputation or abusive domains. The domain appears on one security blocklist, specifically PhishDestroy, and is detected by 3 of 95 security vendors on VirusTotal, indicating confirmed malicious activity. The subdomain structure (sso--moonpay-login---m--auth) suggests an attempt to mimic a single sign-on (SSO) or authentication portal, likely targeting users of MoonPay or a related cryptocurrency service. However, the exact content and brand impersonation have not been fully analyzed, and no additional kit or vendor details are available. The domain’s registration age (over one year) and persistence on hosting infrastructure further support its classification as a high-risk threat. Defenders should prioritize blocking this domain at the DNS and network level, particularly in environments where cryptocurrency-related authentication portals are in use. Monitoring for similar subdomain patterns (e.g., sso--[brand]--login) on Mystrikingly or other free hosting platforms may help identify related campaigns. No SSL or HTTP status anomalies were reported, but the domain’s continued activity warrants immediate action to mitigate credential theft risks.