solmoondrop-g4y9js16jg[.]edgeone[.]app

PhishDestroy identifies solmoondrop-g4y9js16jg.edgeone.app as an active brand impersonation endpoint designed to harvest user credentials under the guise of a legitimate platform. The domain mimics a popular brand’s interface to trick visitors into entering sensitive information such as passwords or payment details. Security telemetry confirms this host resolves to IP 43.152.26.58 and leverages a DigiCert SSL certificate to appear trustworthy. Site behavior suggests a crypto drainer module may be loaded post-credential capture to empty associated digital wallets, mirroring recent attacks on DeFi users. This domain was flagged by Google Safe Browsing under the SOCIAL_ENGINEERING category, indicating active misuse for fraudulent purposes. VirusTotal analysis shows 0 detections out of 95 engines as of latest scan, highlighting the delay between threat emergence and signature updates. Infrastructure records indicate registration via an anonymous registrar with a creation date within the last 90 days, a common tactic to evade historical blocklists. The absence of detections underscores the need for real-time behavioral monitoring rather than relying solely on static signatures. If you visited solmoondrop-g4y9js16jg.edgeone.app, immediately revoke any credentials entered and disconnect linked crypto wallets. Scan local devices with updated antivirus software to detect crypto-draining malware. Report the domain to your organization’s threat intelligence team and submit a takedown request via your browser’s Safe Browsing tool to help protect others.