moonxbit[.]com

The domain moonxbit.com has been confirmed as a cryptocurrency credential phishing site targeting users through a fraudulent login interface. Analysis indicates the site impersonates a legitimate cryptocurrency exchange platform, presenting a login page titled MOONXBIT: Login Page to harvest user credentials. The domain is currently offline, though prior activity suggests active phishing operations. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 21, 2026, and resolves to the IP address 172.67.173.158. Security vendor detections include 4 of 95 engines flagging the domain on VirusTotal, while it appears on a single security blocklist. The site employed multiple technologies, including Node.js, Envoy, React, Next.js, HSTS, Cloudflare, Webpack, and HTTP/3, indicating a sophisticated technical deployment. Open-source threat intelligence platforms recorded the domain in one threat pulse, further corroborating its malicious classification. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized access to cryptocurrency accounts, reset credentials for any services accessed during the exposure window, and implement multi-factor authentication where available. Network-level blocking of the IP 172.67.173.158 is recommended as a precautionary measure. Users should verify domain registration dates and security flags before interacting with cryptocurrency-related login portals.