xn--monshot-cx4c[.]com

PhishDestroy identified xn--monshot-cx4c.com as a brand impersonation phishing domain targeting Moonshot, a cryptocurrency platform. The site displayed the title "Vote to List — Powered by Moonshot" to trick users into believing they were interacting with a legitimate Moonshot feature. This domain likely aimed to harvest login credentials or private keys from victims seeking to participate in token listing votes.

Technical analysis reveals that the domain resolved to IP 104.21.94.122 and was flagged by 11 out of 95 security vendors on VirusTotal, indicating broad detection by the security community. It appeared on three separate blocklists and was registered through NiceNIC International Group Co., Limited, a registrar known for lax verification processes. The domain was created on February 21, 2026, and used a Let's Encrypt SSL certificate (E7), which is common among both legitimate and malicious sites. The domain was not found on Google Safe Browsing blacklists at the time of analysis, but its high VT score and blocklist presence confirm its malicious nature.

As of the latest intelligence, the domain has been taken offline, mitigating immediate risk. However, users who may have visited the site or submitted credentials should change their passwords immediately and enable two-factor authentication on their Moonshot accounts. The remaining risk is low due to the domain's offline status, but similar domains may appear under different homoglyph variations. PhishDestroy recommends monitoring for any suspicious login attempts and reporting similar domains to security teams.