moonpay-logi-auth[.]my[.]canva[.]site

The domain moonpay-logi-auth.my.canva.site has been confirmed as a credential theft site impersonating Moonpay, a popular cryptocurrency platform. This domain was used to trick users into disclosing their login credentials, potentially leading to unauthorized access to their crypto wallets.

Infrastructure analysis reveals that the domain was registered through GANDI SAS on April 03, 2018. It has been identified and flagged by 10 out of 95 security vendors on VirusTotal, indicating a moderate level of recognition among cybersecurity tools. The domain resolves to an IP address 103.169.142.6, which is located in Australia and is associated with AS209242 Cloudflare London, LLC. The SSL certificate is issued by Google Trust Services / WE1, which may lend a false sense of security to unsuspecting users. Additionally, the domain appears on one security blocklist, specifically PhishDestroy.

The domain is currently offline, which suggests that it has been taken down by the registrar or the hosting provider. Despite this, the infrastructure used by the threat actors may still pose a risk, as they could potentially re-register the domain or use similar techniques in the future. Organizations and individuals are advised to remain vigilant and ensure that all login pages for cryptocurrency platforms are verified to be legitimate. Security teams should also monitor for any suspicious activity related to this domain and block any attempts to re-establish it.