moonshot-coins[.]fun

PhishDestroy identifies the active domain moonshot-coins.fun as a crypto drainer exploiting Moonshot brand impersonation. This threat is categorized as elevated-risk due to its deceptive technique targeting cryptocurrency users through fraudulent token promotions. The domain was registered on April 17, 2026, and resolved to IP address 172.67.134.245 at the time of analysis. VirusTotal analysis revealed detection by 2 of 95 security vendors, while Maltrail has already added this domain to its blocklist. PublicDomainRegistry.com facilitated the registration, and the domain employs a Let’s Encrypt SSL certificate for perceived legitimacy. The combination of recent registration, low detection rate, and active blocking underscores the urgency for user vigilance.

Technical indicators reveal this domain is part of a broader campaign designed to deceive users into connecting cryptocurrency wallets under false pretenses. The impersonation of Moonshot—likely targeting investors in the Moonshot token or platform—exploits user trust through visually similar branding and fraudulent promises of high returns. The domain's low trust score across multiple security platforms, including its presence on one blocklist, suggests early-stage deployment typical of opportunistic threat actors. The IP address 172.67.134.245 is associated with multiple high-risk domains, further correlating this domain with malicious infrastructure. SSL certificate issuance via Let’s Encrypt, while common among legitimate sites, is often abused by threat actors to bypass security warnings and establish superficial credibility.

Users are strongly advised to avoid interacting with moonshot-coins.fun or any associated links, especially those promoting free token giveaways or urgent investment opportunities. PhishDestroy recommends verifying any suspicious domain or communication by searching the domain directly on its platform prior to engagement. Always cross-check URLs against official brand domains and use hardware wallet address verification when approving transactions. Report this domain immediately if encountered through PhishDestroy’s reporting system to help strengthen collective defense against such impersonation attempts. Stay vigilant—verify before you trust.