moonshot-add[.]trade

This domain, moonshot-add.trade, operates as a brand impersonation phishing site targeting users of the Moonshot cryptocurrency project. Analysis indicates the infrastructure is designed to deceive victims into believing they are interacting with an official Moonshot platform, likely to facilitate unauthorized transactions, credential harvesting, or the deployment of crypto-draining malware. The domain mimics legitimate Moonshot branding, which could lead to financial loss or compromise of sensitive account information for unsuspecting users.

Evidence supporting this assessment includes detection by 4 out of 95 security vendors on VirusTotal, indicating moderate but consistent recognition of malicious intent. The domain was registered through NiceNIC International Group Co., Limited, on March 04, 2026, a date that may suggest an attempt to evade scrutiny by appearing newly established. It is currently listed on three security blocklists and was proactively blocked by MetaMask, PhishDestroy, and SEAL, further validating its malicious classification. The domain resolves to the IP address 188.114.97.3, which may be part of a broader phishing or bulletproof hosting infrastructure.

Users who visited moonshot-add.trade should immediately cease all interaction with the domain and any associated links. Those who entered credentials or connected wallets should assume compromise and take corrective actions: revoke any connected wallet permissions, transfer assets to a new secure wallet, and monitor accounts for unauthorized transactions. It is also recommended to scan local devices for malware, as phishing sites often distribute secondary payloads. Given the elevated risk level, affected users should report the incident to relevant security teams and consider notifying their cryptocurrency exchange or wallet provider for additional monitoring.