io-moonpaycdn[.]wixstudio[.]com

This domain is flagged as a credential harvesting phishing site targeting cryptocurrency users through a fraudulent MoonPay login portal. Analysis indicates the threat type as generic_phishing with an elevated risk level, designed to deceive victims into submitting sensitive authentication credentials, including wallet access details. Infrastructure analysis reveals the domain io-moonpaycdn.wixstudio.com resolves to the IP address 34.144.206.118 and was registered through GoDaddy.com, LLC. The site employs a Let's Encrypt SSL certificate and utilizes technologies such as Wix, React, Google Cloud, Lodash, HSTS, and Google Cloud CDN. Detection metrics show the domain appears on five security blocklists, including MetaMask, PhishDestroy, PhishingArmy, SEAL, and OISD. A Gridinsoft trust score of 0/100 and a VirusTotal detection ratio of 6/95 further confirm its malicious classification. The page title, Login | MoonPay®®®® — Sign In, explicitly mimics the legitimate MoonPay authentication interface. Mitigation steps for this threat type include immediate blocking of the domain and associated IP address 34.144.206.118 across network security controls. Organizations should update endpoint protection rules to flag similar credential harvesting attempts, particularly those targeting cryptocurrency platforms. Users who may have interacted with the domain should revoke any active sessions, reset credentials, and monitor accounts for unauthorized access. Security teams are advised to review logs for connections to the IP and domain, as well as to implement multi-factor authentication to mitigate future credential-based attacks.