# PhishDestroy threat dossier — moonshot-coins.com ================================================================ Fetched: 2026-07-29 05:14:38 UTC Canonical: https://phishdestroy.io/domain/moonshot-coins.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Moonshot ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 4/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar URLQuery: 2 detections Public blocklists: listed on 2 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Dominet (HK) Limited Nameservers: chuck.ns.cloudflare.com, venus.ns.cloudflare.com Registered: 2026-07-15 Expires: 2027-07-15 Page title: Moonshot HTTP response: 403 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-10-13 Status: INVALID chain Fingerprint: 3cd8141e135f7997456c779481325d9dadf0b638a6acdf67cfd2569ec8124ef4 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-15 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-24 11:07:01 UTC (by PhishDestroy tracker) First reported: 2026-07-24 09:14:28 UTC (abuse notice filed) Last verified: 2026-07-29 05:00:06 UTC Neutralised: 2026-07-25 04:17:52 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f9360-75f2-7770-8a65-59f36d553474/ URLQuery: https://urlquery.net/report/17ec4574-8db7-45da-95d8-4d0a1620d8e5 Wayback Machine: https://web.archive.org/web/*/moonshot-coins.com crt.sh CT logs: https://crt.sh/?q=%25.moonshot-coins.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=moonshot-coins.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/moonshot-coins.com URLhaus: https://urlhaus.abuse.ch/host/moonshot-coins.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-24 11:10:27 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] moonshot-coins.com — Generic Phishing Investigation Analysis date July 24 2026. The domain moonshot-coins.com was registered on July 15 2026 through Dominet (HK) Limited. It resolves to the IPv4 address 188.114.96.3 and uses Cloudflare authoritative nameservers chuck.ns.cloudflare.com and venus.ns.cloudflare.com. The domain appears on two external blocklists and has been actively blocked by PhishDestroy and ScamSniffer, indicating that it is currently being used for malicious activity. VirusTotal has recorded detections from 2 of 91 scanning engines, reinforcing the suspicion of phishing. No public SSL certificate details, HTTP status codes, or page title information have been disclosed in the current intelligence set, so the exact content of the web page remains unknown. The short lifespan between registration and detection suggests a fast‑flux or throwaway phishing campaign. Defenders should add moonshot-coins.com and its IP 188.114.96.3 to deny‑list rules, monitor DNS queries for the associated Cloudflare nameservers, and enforce traffic filtering for any outbound connections to the domain. Continuous re‑scanning with multi‑engine services is recommended to capture any evolution of the payload or additional malicious indicators. Organizations that process financial transactions or cryptocurrency‑related communications should treat any unsolicited messages referencing “moonshot coins” with heightened scrutiny, as the domain name itself appears to target such interests. Because the site’s internal structure and branding have not been publicly harvested, further passive and active reconnaissance is advised to confirm the exact phishing vector and to collect any credential‑stealing forms that may be hosted. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260724-9AB455 Favicon MD5: 9d11ed715aecf68cba94d332d708c838 TLS cert SHA-256: 3cd8141e135f7997456c779481325d9dadf0b638a6acdf67cfd2569ec8124ef4 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/moonshot-coins.com/ JSON API: https://api.destroy.tools/v1/check?domain=moonshot-coins.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 192,591 domains (82,918 alive under monitoring, 107,787 confirmed takedowns/dead). Site: https://phishdestroy.io