moonslogin[.]space

This domain, moonslogin.space, is identified as a credential phishing site specifically designed to mimic legitimate cryptocurrency wallet login portals. Analysis indicates the site employs fraudulent login interfaces to harvest user credentials, likely targeting wallet recovery phrases or private keys. The intent is to facilitate unauthorized access to victims' digital assets, enabling theft or manipulation of funds stored in blockchain-based wallets. The domain's infrastructure and content are engineered to deceive users into believing they are interacting with a trusted service, increasing the likelihood of successful credential compromise. Technical evidence supports the classification of this domain as a high-confidence phishing threat. The domain was registered on June 17, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious registrations. It is currently flagged by 7 out of 95 security vendors on VirusTotal, and appears on three independent security blocklists. The domain resolves to the IP address 104.21.61.146, which has been linked to other phishing campaigns in recent months. Its presence on multiple blocklists, including those maintained by cryptocurrency security entities, further corroborates its malicious intent. Users who have visited moonslogin.space or entered credentials on this site should assume their information has been compromised. Immediate action is required: revoke any active sessions linked to the affected wallet, transfer remaining assets to a new, secure wallet, and monitor all associated accounts for unauthorized transactions. Enable multi-factor authentication on all critical accounts, and review recent transaction histories for anomalies. If recovery phrases or private keys were exposed, consider the original wallet permanently compromised and avoid reusing it. Report the incident to relevant security teams and consider filing a report with local cybercrime authorities to aid in tracking and mitigating further threats.