app-movemoney[.]top

This domain, app-movemoney.top, is identified as a cryptocurrency wallet phishing site designed to harvest sensitive credentials, including private keys and recovery seed phrases. Analysis indicates the infrastructure targets users of decentralized finance (DeFi) platforms and wallet services, likely through deceptive prompts mimicking legitimate interfaces. The threat actors behind this domain aim to gain unauthorized access to digital assets by tricking victims into disclosing authentication details or executing malicious transactions under false pretenses.

Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on May 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to the IP address 104.21.86.124 and employs Cloudflare’s content delivery network alongside HTTP/3, a configuration commonly used to obfuscate hosting origins and evade detection. As of the latest assessment, app-movemoney.top appears on three security blocklists and is flagged by 6 out of 95 security vendors on VirusTotal. Additionally, it holds a Gridinsoft trust score of 0/100, further corroborating its malicious classification. The domain has since been taken offline, though historical exposure remains a concern for users who may have interacted with it during its active period.

Users who visited app-movemoney.top or entered any credentials, seed phrases, or transaction details are advised to take immediate remedial action. First, revoke any active wallet sessions or connected dApp authorizations associated with the compromised credentials. Second, transfer remaining assets to a new wallet with a fresh seed phrase, ensuring the old wallet is no longer used. Third, monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. If financial loss has occurred, report the incident to relevant law enforcement or cybercrime units with all available transaction hashes and timestamps. Proactive measures, such as verifying domain authenticity before interaction and using hardware wallets for high-value assets, are strongly recommended to mitigate future risks.