moongamb[.]com

PhishDestroy has flagged moongamb.com as an active crypto drainer phishing domain currently under investigation. This domain, registered through Hello Internet Corp on February 16, 2026, resolves to IP 66.198.225.39 and has not yet been flagged by VirusTotal (7/95 detections). Its use of a Let's Encrypt SSL certificate suggests an attempt to appear legitimate, potentially luring victims into connecting cryptocurrency wallets or submitting credentials under false pretenses.

Technical indicators reveal a newly registered domain with minimal historical scrutiny, compounded by its lack of detection coverage. The absence of detections (7/95) indicates this threat may be evading traditional security measures, while the recent creation date and specific IP association suggest opportunistic malicious activity. Users should treat this domain with extreme caution, as it may be leveraged in targeted campaigns against cryptocurrency users or financial services.

If you or your organization has encountered this domain, disconnect any connected wallets immediately and scan for unauthorized transactions or malware. Report the domain to your security team and block it at the network level using the IP address (66.198.225.39) and domain name. Consider revoking any permissions granted to cryptocurrency-related sites linked to moongamb.com. Stay vigilant for follow-on phishing attempts, as actors behind such domains often reuse infrastructure for secondary attacks.