view-moonpey[.]wixstudio[.]com

The domain view-moonpey.wixstudio.com has been confirmed as a crypto drainer phishing endpoint designed to compromise cryptocurrency wallet credentials. Analysis indicates the site operated as a fraudulent interface mimicking legitimate wallet connection prompts, enabling unauthorized fund transfers from victims. As of the latest assessment, the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Infrastructure analysis reveals the domain was flagged by 11 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The endpoint resolved to the IP address 34.144.206.118 and was registered through GoDaddy.com, LLC, with an original creation date of December 17, 2016. The domain appeared on five distinct security blocklists, including MetaMask, PhishDestroy, PhishingArmy, SEAL, and OISD. The SSL certificate was issued by Let’s Encrypt, a common trait among phishing sites leveraging free certificates to appear legitimate. Current status indicates the domain is offline, though historical exposure may persist for affected users. Organizations and individuals are advised to block the domain and associated IP at the network level, revoke any wallet authorizations granted during the exposure window, and monitor for unauthorized transactions. Users who connected wallets to this endpoint should assume credential compromise and transfer assets to new, secure wallets immediately. Proactive threat hunting for related indicators of compromise is recommended to mitigate further risk.