moonshot[.]com[.]bi

Analysis of moonshot.com.bi confirms active brand impersonation targeting Moonshot, a cryptocurrency platform. The domain, registered on February 21, 2026, resolves to 91.92.241.15 (AS202412, Omegatech LTD, Netherlands) and is served by nameservers ns1.virtualine.org and ns2.virtualine.org. The site returns an HTTP 200 status and presents a generic WordPress blog page titled 'My Blog – My WordPress Blog,' indicating a likely placeholder or staging environment for malicious activity. SSL is provided by Let's Encrypt (R12), and the site uses Tailwind CSS and HTTP/3, suggesting recent infrastructure deployment. The domain is flagged by one security blocklist (PhishDestroy) and detected by 5 of 93 vendors on VirusTotal, with a Gridinsoft trust score of 0/100. No specific phishing kit or lure content has been confirmed, but the scam type is classified as cryptocurrency-related. The combination of brand impersonation, cryptocurrency targeting, and low detection thresholds warrants immediate blocking. Defenders should treat this domain as high-risk and monitor associated IP and nameserver infrastructure for further malicious activity. The exact nature of the scam (e.g., fake token sales, wallet drainers) remains unconfirmed due to lack of page content analysis.