# moonshot.votecoins.xyz — SUSPICIOUS

> PhishDestroy identifies moonshot.votecoins.xyz as a live Moonshot brand impersonation scam. VT score 0/95. Check the full report.

## Summary
PhishDestroy identifies moonshot.votecoins.xyz as an active brand-impersonation domain targeting Moonshot users. The site was registered on March 11, 2026 and resolves to IP 104.21.15.74. It is currently served over a Let's Encrypt SSL certificate and exhibits no detections on VirusTotal (0/95). The domain is hosted under NICENIC INTERNATIONAL GROUP CO., LIMITED and remains unlisted by Google Safe Browsing. The low detection rate suggests a newly deployed impersonation campaign designed to harvest credentials and cryptocurrency from unsuspecting Moonshot users.

Technical indicators align with a high-risk brand impersonation operation. Domain creation date is March 11, 2026. VirusTotal shows 0 detections out of 95 engines. The registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED. The IP address 104.21.15.74 is shared with multiple suspicious domains. The domain is not flagged by Google Safe Browsing, and no public blocklists currently include it. The absence of detections indicates the threat is still in early deployment, with potential for rapid expansion if undetected.

The campaign is currently active and under investigation. PhishDestroy has flagged moonshot.votecoins.xyz as a confirmed impersonation site targeting Moonshot. Users are advised to avoid interacting with this domain and to report any encounters. Immediate actions include domain takedown requests and IP-based blocking by hosting providers. The remaining risk is moderate due to low visibility and lack of detection, but escalation is likely as the campaign gains traction. Users should verify all URLs before inputting credentials and enable multi-factor authentication where available.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Moonshot

## Domain Intelligence
- Registered: 2026-03-11 21:49:04
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 104.21.15.74

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/moonshot.votecoins.xyz
- PhishDestroy: https://phishdestroy.io/domain/moonshot.votecoins.xyz/
- LLM endpoint: https://phishdestroy.io/domain/moonshot.votecoins.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/moonshot.votecoins.xyz/
Last updated: 2026-04-05