# PhishDestroy threat dossier — moonshot-enter.community ================================================================ Fetched: 2026-06-21 22:28:10 UTC Canonical: https://phishdestroy.io/domain/moonshot-enter.community/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Moonshot Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_split) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 19/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, CRDF, CyRadar, Ermes, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, Netcraft, SOCRadar, Sophos, VIPRE, Webroot AlienVault OTX: 4 pulses (threat-intel feed mentions) Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- Registrar: Name.com, Inc. Nameservers: ["ns1.vercel-dns.com", "ns2.vercel-dns.com"] Registered: 2026-06-08 Page title: Vote to List — Powered by Moonshot ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-08 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-09 00:54:17 UTC (by PhishDestroy tracker) First reported: 2026-06-08 23:31:25 UTC (abuse notice filed) Last verified: 2026-06-22 00:20:33 UTC Neutralised: 2026-06-11 18:48:57 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-18 16:38:59 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] The domain moonshot-enter.community has been identified as a brand impersonation threat, specifically targeting Moonshot, and is currently offline. This domain was flagged by 19 of 95 VirusTotal vendors, indicating a high level of suspicion, and was registered through Name.com, Inc. on June 08, 2026, it also appears on 3 security blocklists, which further supports the notion that this domain poses a significant threat to users. This domain was created recently and has already been flagged by multiple security vendors, which suggests that it is being used for malicious purposes, the registrar Name.com, Inc. has been used to register this domain, and with a creation date of June 08, 2026, it is clear that this domain is a relatively new threat, the fact that 19 out of 95 VirusTotal vendors have flagged this domain is a strong indicator of its malicious nature, and the presence on 3 security blocklists adds to the urgency of the situation. Given the current status of the domain, which is offline, and the fact that it has been flagged by multiple security vendors, PhishDestroy recommends that users exercise extreme caution when dealing with this domain, as it poses a significant threat to their online security, to avoid falling victim to brand impersonation threats, users should always verify the authenticity of a website before interacting with it, and reporting any suspicious activity to the relevant authorities is also crucial, by taking these precautions, users can protect themselves from the potential harm that this domain could cause. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: c011c4183fccc9e1bd2c1e82d01f63fe ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/moonshot-enter.community/ JSON API: https://api.destroy.tools/v1/check?domain=moonshot-enter.community Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 167,452 domains (11,852 alive under monitoring, 155,169 confirmed takedowns/dead). Site: https://phishdestroy.io