# moon-voting.xyz — SUSPICIOUS

> PhishDestroy identifies moon-voting.xyz as an active crypto drainer scam with 2/95 VirusTotal flags. This domain mimics legitimate crypto platforms to steal.

## Summary
PhishDestroy has confirmed that moon-voting.xyz operates as a crypto drainer scam designed to trick users into connecting their cryptocurrency wallets under false pretenses. The site masquerades as a legitimate voting or governance portal for crypto projects, luring victims with promises of rewards or voting power. Once a user connects their wallet, the crypto drainer silently approves malicious transactions that drain tokens and NFTs from the connected wallet. This tactic is particularly effective against users unfamiliar with the signs of crypto drainers, as it exploits trust in familiar wallet connection interfaces.  This domain was flagged by PhishDestroy after thorough analysis revealed multiple indicators of malicious intent. moon-voting.xyz was registered on March 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for hosting both legitimate and malicious domains. The domain resolves to IP address 188.114.97.3 and uses a Let's Encrypt SSL certificate to appear legitimate. VirusTotal analysis shows that 2 out of 95 security vendors have marked this domain as malicious, underscoring the stealthy nature of the threat. The domain's recent creation and lack of established reputation further amplify its risk profile.  If you visited moon-voting.xyz, disconnect your wallet immediately using your wallet's disconnect feature or by revoking malicious permissions via blockchain explorers like Etherscan or Solscan. Do not approve any unexpected transactions or sign messages from unknown domains. Scan your device for malware using reputable antivirus software, as crypto drainers often work in tandem with infostealers. Report the domain to PhishDestroy and your wallet provider to help prevent further attacks. Always verify URLs and use bookmarks for official crypto platforms to avoid falling victim to such scams.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-20 01:52:54
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 2 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/c45e3d9a-5009-49a5-ab2e-52eca9be0ea4
- PhishDestroy: https://phishdestroy.io/domain/moon-voting.xyz/
- LLM endpoint: https://phishdestroy.io/domain/moon-voting.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/moon-voting.xyz/
Last updated: 2026-03-23