x-moonshot[.]net

PhishDestroy identifies the active domain x-moonshot.net as an elevated-brand-impersonation threat currently hosting a crypto-drainer operation targeting unsuspecting cryptocurrency holders. The site masquerades as the legitimate Moonshot brand, luring visitors to connect digital wallets and authorize malicious transactions. At the time of analysis, this domain remains online and is actively serving malicious JavaScript designed to exfiltrate private keys and drain funds. This domain was flagged by 1 of 95 VirusTotal security vendors, carries a Let’s Encrypt SSL certificate for an added veneer of legitimacy, and resolves to the IP address 188.114.96.3. Registered through PDR Ltd. d/b/a PublicDomainRegistry.com on April 23, 2026, the domain has not yet attracted significant blocklisting attention, reflecting the recency of its campaign. Trust scores across threat intelligence networks remain low, with composite ratings clustering in the lowest decile, underscoring the need for immediate defensive action. Given the domain’s active status, low detection ratio, and direct impersonation of a well-known brand, users are strongly advised to avoid interacting with any content hosted at x-moonshot.net. Entering a wallet address or clicking prompts on this site may result in irreversible cryptocurrency losses. To verify legitimate domains and protect assets, rely on PhishDestroy’s real-time lookup tool, which cross-references 30+ threat feeds and community reports. Report suspicious encounters immediately to help expand blocklists and safeguard the broader ecosystem.