home-moonpay[.]wixstudio[.]com

PhishDestroy identifies home-moonpay.wixstudio.com as an active crypto drainer phishing domain impersonating the legitimate MoonPay service. The site leverages a spoofed WixStudio subdomain to host a malicious drainer kit designed to steal cryptocurrency funds from unsuspecting victims. This campaign is part of a broader trend where threat actors abuse reputable hosting platforms to lend false legitimacy to their fraudulent operations. This domain presents several concrete technical indicators that warrant caution. VirusTotal currently reports 11/95 detections, indicating it has not yet been widely flagged by security vendors. It resolves to IP address 34.144.206.118 and is secured by a Let’s Encrypt SSL certificate, which may help it evade detection. The domain was registered through an unspecified registrar and has appeared on multiple security blocklists, though the exact number is unspecified. Its Generic Security Block (GSB) status is negative, and it is already blocked by MetaMask and SEAL, two prominent crypto security platforms. As of the latest assessment, home-moonpay.wixstudio.com remains active and under active investigation by PhishDestroy’s threat intelligence team. The domain continues to pose a moderate risk to users who may encounter it through phishing emails, social media links, or malicious ads. While immediate detection remains low due to the 11/95 VirusTotal score, ongoing monitoring and proactive blocking by security tools like PhishDestroy are critical to mitigating exposure. Users are strongly advised to verify any suspicious link using PhishDestroy’s real-time scanner before entering credentials or making transactions.