verify-bitmoon[.]fun

This domain, verify-bitmoon.fun, is actively engaged in credential phishing targeting users of the BitMoon cryptocurrency wallet platform. Analysis of the page title, which explicitly displays 'BitMoon,' indicates an attempt to deceive visitors into believing they are accessing a legitimate wallet login or verification portal. The infrastructure is designed to harvest login credentials, seed phrases, or private keys, which could lead to unauthorized access and theft of digital assets stored in victim wallets. The threat is particularly acute given the irreversible nature of cryptocurrency transactions once initiated by attackers. Infrastructure analysis reveals several critical indicators. The domain verify-bitmoon.fun was registered on July 01, 2026, through Porkbun LLC, a registrar commonly used for both legitimate and malicious domains. It resolves to the IP address 178.16.52.100 and is secured with a Let's Encrypt SSL certificate, which provides a false sense of security to potential victims. As of the latest scan, only 2 out of 95 security vendors on VirusTotal have flagged this domain as malicious, suggesting it remains under-detected and continues to evade widespread blocklisting. No additional blocklist entries were identified at the time of this report, further indicating its operational persistence. Users who have visited verify-bitmoon.fun or entered credentials on the site should assume their information has been compromised. Immediate action is required: revoke any active sessions, change passwords for associated accounts, and transfer cryptocurrency holdings to a new, secure wallet with a fresh seed phrase. Enable multi-factor authentication on all related services where available. Monitor financial and transactional accounts for unauthorized activity and report any suspicious transactions to the relevant platform. If private keys or recovery phrases were entered, consider the associated wallet and all funds within it as exposed and at risk.