moonshot-addmeme[.]com

PhishDestroy identifies moonshot-addmeme.com as an active crypto drainer impersonating the Moonshot brand, currently under investigation by security researchers. The domain uses a deceptive naming scheme likely aimed at tricking users into connecting crypto wallets or entering credentials under false pretenses. No known drainer kit artifacts were publicly available at the time of assessment, but the site’s structure and branding alignment suggest high-risk behavior targeting cryptocurrency users. This domain was flagged with critical indicators including a 0/95 detection score on VirusTotal, a highly suspicious finding given the site’s impersonation of a legitimate brand. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolved to IP address 172.67.188.214, and was created on April 24, 2026. It holds a valid Let's Encrypt SSL certificate and is not yet blocked by Google Safe Browsing. The domain remains unlisted on major threat intelligence blocklists, indicating its recent emergence and low prior detection coverage. As of this assessment, moonshot-addmeme.com is active and poses an imminent threat to cryptocurrency users unfamiliar with the Moonshot brand or the risks of impersonation domains. Response actions include ongoing monitoring and signature updates to detection systems; however, the domain remains unblocked and accessible. Remaining risk is classified as elevated due to the combination of zero detections, recent creation, and impersonation tactics. Users are strongly advised to verify any interaction with this domain using PhishDestroy or a trusted security tool before taking any action involving cryptocurrency or personal data.