Fake vote pages find new coins at launch, long before they run

If you search a new coin's contract address on X, some of the first posts you find will be lures: "Attention $OWL Family! YOUR vote matters!", or "open fomo and back" the coin, with a link to a vote page. We have traced one of these campaigns before to a wallet drainer. This time we wanted to know when they show up.

Update, 5 October, 7:00 PM ET: since we published at 1:08 PM ET, four more lure sites have turned up on coins we follow. Two are fake "allocation" pages, each pushed by an old X account renamed for the coin and posting the same two-part thread every few minutes: teamhumansol.com for $HUMAN, registered on the evening of 4 October (our chatter), and superinsolana.com for Super Inu, registered on the evening of 29 September (our chatter). One is a fake "Axiom Vote", axmlist.help, registered on the evening of 2 October; its own code says "new fake vote every 6–22s", and by our count it was posted for dozens of coins, at one point 18 in five minutes (our chatter). At 6:53 PM ET the site had stopped answering. The fourth, packscan.co, is a "portfolio scanner" wearing Backpack's branding. It says "No wallet signature required", then asks visitors to "Approve to scan any amount", and it loads a hidden script the same way as the fake Moonshot vote pages. Reply posts pushed it on $Cadence and $PLAGUE, spelling "Scan" and "Report" with Cyrillic letters. Don't connect a wallet to any of them.

We took the ten coins that made the biggest moves in our tracker on Monday, 5 October, and searched X for the earliest lure post carrying each coin's own contract address. Times below are from each post's own timestamp, and each coin's creation time is from Jupiter. X search doesn't index everything, so a lure could have come even earlier.

The answer: the lures don't chase a coin that's running. They find it at launch. $OWL's first lure came 5 minutes after the coin was created, $Instinct's 11 minutes after and $HIGGS's 25 minutes after. Seven of the ten were hit within 76 minutes. Every coin had lures days or hours before Monday's run, and the posts kept coming, minutes apart, before and after each run started. That reads as scheduled posting across every new coin, not a reaction to price.

The kits are shared. One set of posts sends people to look-alike "Moonshot" vote pages on netlify.app, reached through tinyurl links; a second sends them to numbered "fomo vote" pages on pages.dev. The same page addresses turn up on many coins, and both kinds ask visitors to connect a wallet. Moonshot has said that "anyone telling you to vote, click a link, or send money to get verified is a scam."

Bigger coins got sites of their own. jeango.top, a "$JEANPHIL early users can claim their share" site, was registered on 25 September, six days after the coin launched, and pushed by copy-paste accounts during Monday's run (our chatter). rewards-higgs.com, a "$HIGGS holder rewards dashboard", was registered at 8:14 AM ET Monday, about two and a half hours before the first post pushing it, and pushed by an account that copies Higgspad's bio (our chatter). Neither coin's own accounts or DexScreener links mention a claim or a rewards dashboard. We couldn't load either site past its bot check.

Why does this work? A brand-new coin's holders are searching for news, a listing, anything that might send it higher. A "vote to list" or a "claim" fits exactly what they're hoping for, and the posts reach them at the moment they're most likely to click.

How to tell: a coin has a claim, a vote or a rewards dashboard only if its own X account and the links on its DexScreener profile say so. Moonshot says it doesn't run votes this way, and none of these coins' own channels pointed to one. Any vote, claim or verify page that asks you to connect a wallet is the tell. If you've connected a wallet to one, move what's left to a new wallet and revoke approvals you don't recognise.