app-sandbox[.]moonpay-staging[.]com

The domain app-sandbox.moonpay-staging.com is currently active and resolves to the IP address 104.18.5.205. The host was created on 21 February 2026 and is serviced by Cloudflare’s DNS infrastructure (arch.ns.cloudflare.com, hope.ns.cloudflare.com). An SSL certificate issued by Google Trust Services (WE1) is presented, and the site returns HTTP 200 responses. The page title observed is “MoonPay”, matching the reported scam type of banking phishing.

Infrastructure analysis shows the address belongs to AS13335, operated by Cloudflare in the United States. The hosting stack includes Envoy, Google Cloud, Vercel, Google Pay, LaunchDarkly, HSTS, Google Cloud CDN, and Cloudflare, indicating a layered content‑delivery configuration that can obscure the true origin of malicious payloads. The domain is listed on three public security blocklists, and its Gridinsoft trust score is 0 out of 100, reflecting an extreme lack of reputation.

Threat intelligence feeds have flagged the site on PhishDestroy, MetaMask, and SEAL, and VirusTotal records show two out of ninety‑five scanning engines flagging the domain as malicious. The combination of a low trust score, blocklist presence, and multiple independent detections aligns with the high‑risk rating assigned to the domain. No additional content analysis is available beyond the page title, so the exact phishing payload remains unverified.

Defenders should block network traffic to 104.18.5.205 and add app-sandbox.moonpay-staging.com to URL filtering policies. Email security gateways ought to treat any messages referencing the MoonPay brand that contain links to this domain as suspicious. Continuous monitoring of Cloudflare‑hosted subdomains for similar naming patterns is recommended, and incident response teams should be prepared to investigate credential‑theft attempts that reference the observed banking phishing scenario.