xn--moonhots-7vb[.]net

PhishDestroy has identified a brand impersonation threat targeting Moonshot users through the domain xn--moonhots-7vb.net. This domain masquerades as a legitimate Moonshot platform, featuring a page titled 'Vote to List — Powered by Moonshot' to deceive visitors into believing they are interacting with an official service. The threat type is brand impersonation, and while no specific drainer kit has been confirmed, the site's design and purpose strongly suggest it is engineered to harvest credentials or prompt users to connect wallets, leading to potential asset theft.

Technical analysis reveals critical indicators of malicious intent. The domain was created on February 21, 2026, and is registered through NiceNIC International Group Co., Limited, a registrar often associated with suspicious domains. It resolves to IP address 172.67.179.9 and uses a Let's Encrypt SSL certificate (E7) to appear legitimate. VirusTotal data shows that 5 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. The domain is not listed on Google Safe Browsing (GSB) at this time, which may delay detection by some browsers.

The current status of xn--moonhots-7vb.net is offline, indicating that PhishDestroy or partner entities have successfully taken action to disrupt its operation. However, the domain remains registered and could be reactivated or redirected. Users should remain vigilant and verify any Moonshot-related URLs through official channels. PhishDestroy recommends always checking the domain against known legitimate URLs and using bookmark links rather than clicking on unsolicited links. If you encounter this domain, avoid interacting with it and report it to PhishDestroy for further analysis.