startio-monpaycdn[.]wixstudio[.]com

The domain startio-monpaycdn.wixstudio.com has been assessed as an elevated risk MoonPay phishing domain. The specific threat category is generic_phishing, indicating that the domain is designed to impersonate MoonPay's legitimate login page to steal user credentials and personal information.

Analysis indicates that this domain was flagged by 5 out of 95 security vendors on VirusTotal, suggesting a relatively low but notable detection rate. The domain is registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118. The SSL certificate is issued by Let's Encrypt, a common certificate authority used by legitimate and malicious sites alike. The site employs technologies such as Wix, React, Google Cloud, Lodash, HSTS, Google Cloud CDN, and HTTP/3 to create a more convincing and secure-seeming environment. The domain appears on 5 security blocklists and is blocked by MetaMask, PhishDestroy, PhishingArmy, SEAL, and OISD. Additionally, the Gridinsoft trust score is 0/100, indicating a complete lack of trust in the domain. The page title 'Login | MoonPay®® — Sign In™' closely mimics the legitimate MoonPay login page, further enhancing the deception.

To mitigate the risk associated with this MoonPay phishing domain, users are advised to verify the URL of any MoonPay login page they visit. Always ensure that the domain is moonpay.com before entering any credentials. Use multi-factor authentication (MFA) whenever possible to add an additional layer of security. Security teams should update their threat intelligence feeds to include this domain and block it at the network level. Additionally, employing DNS-based filtering solutions can help prevent access to this domain and other similar threats. Regularly monitor user access logs for any suspicious activity and conduct phishing awareness training to educate employees on recognizing and avoiding phishing attempts.