moonpay[.]ai

This domain, moonpay.ai, is identified as a brand impersonation threat specifically targeting users of the Argent crypto wallet. Analysis indicates the site was designed to deceive victims into believing they are interacting with a legitimate service, likely to facilitate credential theft or unauthorized transactions. The domain exhibits no direct evidence of hosting a crypto drainer kit, but its structure and timing align with known impersonation tactics used to exploit trust in established brands. The threat actor appears to have leveraged the similarity in naming conventions to maximize deception, particularly among users unfamiliar with the authentic service’s domain infrastructure. Infrastructure analysis reveals several critical technical indicators. The domain was registered on October 12, 2025, through GoDaddy.com, LLC, a registrar frequently abused for malicious campaigns due to its accessibility and bulk registration options. It resolves to the IP address 44.232.173.249, which has been associated with other suspicious activities. At the time of assessment, 7 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Gridinsoft assigned it a trust score of 0/100. The domain appears on at least one security blocklist and was blocked by PhishDestroy. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. Detected technologies include Nginx, OpenResty, and HTTP Strict Transport Security (HSTS), suggesting an attempt to mimic secure, production-grade web infrastructure. As of the latest assessment, moonpay.ai has been taken offline, likely in response to detection and reporting. However, the elevated risk remains due to the domain’s recent registration and its potential for re-emergence under altered infrastructure. Users who may have interacted with the domain should immediately revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations targeting crypto users are advised to proactively block the domain and its associated IP across security controls. The presence of HSTS headers, while indicative of an attempt to appear legitimate, does not mitigate the underlying threat. Continuous monitoring of newly registered domains with similar naming patterns is recommended to preempt further impersonation attempts.