moanpay-cdn-sso-autth[.]my[.]canva[.]site

This domain, moanpay-cdn-sso-autth.my.canva.site, is identified as a fraudulent login portal impersonating Moonpay, a cryptocurrency payment service. Analysis indicates the threat type as a generic phishing site designed to harvest user credentials under the guise of a secure wallet login. The page title, 'Moonpay Login | Secure Login | Secure Wallet,' reinforces the deception by mimicking legitimate Moonpay branding, likely targeting users attempting to access their crypto wallets or make transactions. Infrastructure analysis reveals concrete technical indicators: the domain is flagged by 10 out of 95 security vendors on VirusTotal, suggesting moderate to high detection confidence. It was registered through GANDI SAS on April 03, 2018, though the specific phishing content appears to be a more recent deployment. The domain resolves to the IP address 103.169.142.250, hosted under AS209242 Cloudflare London, LLC, with a geolocation in Australia. It appears on one security blocklist, and while no Google Safe Browsing (GSB) status is explicitly noted, the combination of indicators confirms malicious intent. As of the latest assessment, the domain has been taken offline, reducing immediate risk to users. However, residual threats remain, particularly if the infrastructure is repurposed or if users were previously exposed to the phishing page. Response actions should include monitoring for related domains or IPs, as threat actors often rotate infrastructure. Users who may have interacted with the site are advised to reset credentials, enable multi-factor authentication, and review wallet transactions for unauthorized activity. The elevated risk level underscores the need for continued vigilance in cryptocurrency-related authentication flows.