moonshot-trendings[.]digital

PhishDestroy identifies moonshot-trendings.digital as an active brand impersonation domain specifically targeting the Moonshot ecosystem. This domain is flagged for distributing a crypto drainer—a malicious tool designed to siphon cryptocurrency assets from victims’ wallets upon transaction approval. The threat is classified as active and under investigation, with a current risk level pending further behavioral analysis. This domain resolves to IP 104.21.5.18, utilizes a SSL certificate issued by Let’s Encrypt, and was registered through Dynadot Inc on April 26, 2026. As of the same date, VirusTotal reports 0 detections out of 95 scanners, suggesting no current AV coverage for this specific strain. The domain remains unlisted on major threat intelligence blocklists at time of writing, though trust scores and historical associations are still under evaluation.

This impersonation campaign leverages the recognizable Moonshot brand to deceive users into connecting their wallets or approving transactions on a counterfeit platform hosted at moonshot-trendings.digital. The crypto drainer embedded in the site likely operates by prompting victims to sign malicious transactions that transfer funds to attacker-controlled wallets, a common tactic in modern web3 attacks. The domain’s recent creation (April 26, 2026) and low detection rate indicate a potentially emerging or highly targeted operation. While no historical abuse is recorded yet, the combination of brand trust exploitation, web3-specific attack vector, and low AV visibility elevates the risk to users in cryptocurrency and Web3 communities. The SSL certificate, though legitimate via Let’s Encrypt, does not validate the site’s legitimacy—only its encryption capability.

To mitigate exposure to this threat, users are advised to avoid clicking on links from unsolicited messages or social media posts referencing “moonshot-trendings.digital” or similar variants. Always verify official communication directly through Moonshot’s verified channels. Use PhishDestroy’s real-time domain lookup to confirm legitimacy before interacting with any site asking for wallet connections or transaction approvals. If compromised, immediately revoke any unauthorized smart contract approvals via tools like Revoke.cash and transfer remaining assets to a new, secure wallet. Report this domain to PhishDestroy for further analysis and community protection.