io-starts-moonpay[.]wixstudio[.]com

The domain io-starts-moonpay.wixstudio.com was registered on 17 December 2016 through the Wix Studio platform and is currently hosted on NS1 infrastructure, as indicated by its four authoritative nameservers (dns1.p08.nsone.net through dns4.p08.nsone.net). The domain appears on at least one public security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that it is recognized as a malicious resource. VirusTotal scans show that 10 of 91 antivirus and URL‑reputation engines flag the domain, providing independent corroboration of its suspicious nature.

No public page title or brand‑target information is available, so the exact impersonated service cannot be confirmed at this time. The limited metadata suggests a classic generic phishing infrastructure: an older registration date, use of a free‑form website builder (Wix Studio), and reliance on widely used DNS providers to obscure hosting details.

Defenders should treat the domain as active and elevated‑risk, enforce deny‑list rules in network and email filters, and monitor DNS queries for the listed NS1 nameservers to detect any related sub‑domains that may be spun up in the same hosting environment. Continuous re‑evaluation is advised, as additional analysis of the landing page content or TLS certificates could reveal the targeted brand or further indicators of compromise.