xn--moonpy-fua[.]com

PhishDestroy identifies xn--moonpy-fua.com as an active brand impersonation phishing domain designed to mimic legitimate Ethereum services. This domain replicates the branding and page title of MoonPay, a legitimate cryptocurrency service, to deceive users into entering sensitive information under the guise of facilitating Ethereum transactions. The threat actor registered this domain through Squarespace Domains II LLC on July 25, 2025, and deployed it with a Let's Encrypt SSL certificate hosted at IP 198.49.23.145. Security blocklists confirm its malicious intent, with 2 vendors flagging it alongside MetaMask and SEAL blocking access, indicating elevated risk for cryptocurrency users. Evidence of this domain's malicious nature is corroborated by concrete data: VirusTotal reports 1 out of 95 security vendors detect it as a threat, while 2 separate security blocklists flag it. The domain’s recent creation date of July 25, 2025, further suggests opportunistic registration targeting Ethereum users. The page title and visual mimicry of MoonPay’s legitimate service amplify the risk, as unsuspecting users may unknowingly enter credentials or payment details. If you visited this domain, assume your cryptocurrency-related credentials or personal data may have been compromised. Cease all interactions with this site immediately and revoke any permissions granted to it. Scan your devices for malware, update passwords for Ethereum and cryptocurrency-related accounts, and enable two-factor authentication where possible. Report the domain to your security vendor or browser blocklists if you have not already done so. For further details, consult the full threat report associated with seed 51f0e8.