new-io-moonpay[.]wixstudio[.]com

This domain is flagged as an elevated-risk crypto wallet phishing site targeting cryptocurrency users through credential harvesting and wallet-draining schemes. Analysis indicates the infrastructure was specifically designed to mimic legitimate wallet service portals, with technical indicators suggesting a focus on decentralized finance (DeFi) platforms and browser-based wallet extensions. Infrastructure analysis reveals the domain new-io-moonpay.wixstudio.com was registered through GoDaddy.com, LLC on December 17, 2016, and currently resolves to IP address 34.144.206.118. The domain appears on 5 security blocklists, including MetaMask, PhishDestroy, PhishingArmy, SEAL, and OISD. VirusTotal detection shows 5 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The site uses a Let's Encrypt SSL certificate, which provides basic encryption but does not validate legitimacy. Mitigation requires immediate action from both end users and security teams. Users should verify wallet addresses through official channels before transactions and enable hardware-based or multi-signature authentication for all crypto wallets. Security teams should implement DNS-based blocking of the domain and its resolved IP address, while monitoring for related subdomains or newly registered lookalike domains. Network-level detection rules should be updated to flag any connections to 34.144.206.118 or domains containing 'moonpay' in combination with 'io' or 'new' patterns. Wallet providers should proactively warn users about this specific threat pattern through in-app notifications and transaction verification prompts.