moonshot[.]votecoins[.]xyz

PhishDestroy identifies moonshot.votecoins.xyz as an active brand-impersonation domain targeting Moonshot users. The site was registered on March 11, 2026 and resolves to IP 104.21.15.74. It is currently served over a Let's Encrypt SSL certificate and exhibits no detections on VirusTotal (5/95). The domain is hosted under NICENIC INTERNATIONAL GROUP CO., LIMITED and remains unlisted by Google Safe Browsing. The low detection rate suggests a newly deployed impersonation campaign designed to harvest credentials and cryptocurrency from unsuspecting Moonshot users.

Technical indicators align with a high-risk brand impersonation operation. Domain creation date is March 11, 2026. VirusTotal shows 0 detections out of 95 engines. The registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED. The IP address 104.21.15.74 is shared with multiple suspicious domains. The domain is not flagged by Google Safe Browsing, and no public blocklists currently include it. The absence of detections indicates the threat is still in early deployment, with potential for rapid expansion if undetected.

The campaign is currently active and under investigation. PhishDestroy has flagged moonshot.votecoins.xyz as a confirmed impersonation site targeting Moonshot. Users are advised to avoid interacting with this domain and to report any encounters. Immediate actions include domain takedown requests and IP-based blocking by hosting providers. The remaining risk is moderate due to low visibility and lack of detection, but escalation is likely as the campaign gains traction. Users should verify all URLs before inputting credentials and enable multi-factor authentication where available.