moon-bag[.]fun

PhishDestroy identifies moon-bag.fun as a generic phishing domain under active investigation for hosting a fake cryptocurrency wallet drainer kit. The domain mimics legitimate wallet services to deceive users into connecting their wallets and approving malicious transactions. No specific brand impersonation or advanced drainer kit signatures (e.g., clipboard malware or fake wallet interfaces) have been confirmed in initial analysis, but the threat type remains consistent with credential and asset theft campaigns targeting crypto users. The domain does not appear to leverage sophisticated obfuscation or known malware families at this stage.

This domain was flagged with a VirusTotal detection score of 1/95 engines, indicating it has not yet been widely recognized as malicious by security vendors. It was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, resolves to IP address 64.29.17.65, and was created on June 30, 2025. It holds a valid SSL certificate issued by Let's Encrypt, which may be used to enhance phishing credibility. As of this report, the domain has not been listed on major blocklists (e.g., Google Safe Browsing, PhishTank, OpenPhish) and remains unblocked by default in most threat intelligence platforms.

The domain is currently active and flagged as 'under_investigation,' with a status of 'active' in the threat database. Immediate response includes flagging the domain for community reporting and real-time blocking in security tools. Users are advised to avoid accessing moon-bag.fun and report any interactions to their security teams. Remaining risk is classified as moderate due to the domain's newness, lack of detections, and use of a legitimate SSL certificate, which could enable successful deception campaigns against unsuspecting cryptocurrency users.