moonshot[.]lvte[.]cc

The domain moonshot.lvte.cc was a phishing site engaged in brand impersonation targeting Moonshot, a cryptocurrency platform. It posed an elevated risk by mimicking the legitimate brand to deceive users into participating in fraudulent cryptocurrency schemes. The site has since been taken offline, but it previously operated without a known drainer kit and was classified as a cryptocurrency scam.

Technical analysis of moonshot.lvte.cc revealed limited detection by security vendors, with 3 of 95 VirusTotal vendors flagging the domain, including alphaMountain.ai, Forcepoint ThreatSeeker, and SOCRadar. The domain was registered through HOSTINGER operations, UAB, on March 22, 2026, and resolved to the IP address 147.78.64.164, hosted by Firstbyte Hosting in Russia. It appeared on 1 security blocklist (PhishDestroy) and had no SSL certificate. The observed page title was 'Vote to List — Powered by Moonshot,' and the site used technologies such as Ubuntu, Nginx, and Unpkg. Gridinsoft assigned it a trust score of 0/100, further indicating its malicious nature.

Users who interacted with moonshot.lvte.cc should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new, secure wallet to prevent unauthorized access. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA). Report the domain to relevant platforms, such as Google Safe Browsing, PhishTank, or the impersonated brand’s official security team, to aid in mitigating further threats.