# Fake vote pages find new coins at launch, long before they run

Source: trenchbook.app · filed Oct 5, 2026, updated Oct 5, 2026 · https://trenchbook.app/dispatch/lures-find-new-coins

> There is no official trenchbook token or contract address (CA). Anyone selling one is not us.

**In short:** We checked ten Solana coins that made big moves on Monday 5 October for posts pushing fake vote, claim or rewards pages. On every one, the first such post came before the run, from 7 hours to 18 days earlier. On seven of the ten it came within 76 minutes of the coin's creation; the fastest, on $OWL, came 5 minutes after launch. The pages pose as Moonshot or fomo listing votes and ask visitors to connect a wallet. Two bigger coins also got their own fake sites: a $JEANPHIL "claim" and a $HIGGS "rewards dashboard".
If you search a new coin's contract address on X, some of the first posts you find will be lures: "Attention $OWL Family! YOUR vote matters!", or "open fomo and back" the coin, with a link to a vote page. We have [traced one of these campaigns before](https://trenchbook.app/dispatch/moonshot-vote-drainer) to a wallet drainer. This time we wanted to know when they show up.
Update, 5 October, 7:00 PM ET: since we published at 1:08 PM ET, four more lure sites have turned up on coins we follow. Two are fake "allocation" pages, each pushed by an old X account renamed for the coin and posting the same two-part thread every few minutes: teamhumansol.com for $HUMAN, registered on the evening of 4 October ([our chatter](https://trenchbook.app/chatter#c49)), and superinsolana.com for Super Inu, registered on the evening of 29 September ([our chatter](https://trenchbook.app/chatter#c56)). One is a fake "Axiom Vote", axmlist.help, registered on the evening of 2 October; its own code says "new fake vote every 6–22s", and by our count it was posted for dozens of coins, at one point 18 in five minutes ([our chatter](https://trenchbook.app/chatter#c50)). At 6:53 PM ET the site had stopped answering. The fourth, packscan.co, is a "portfolio scanner" wearing Backpack's branding. It says "No wallet signature required", then asks visitors to "Approve to scan any amount", and it loads a hidden script the same way as the fake Moonshot vote pages. Reply posts pushed it on $Cadence and $PLAGUE, spelling "Scan" and "Report" with Cyrillic letters. Don't connect a wallet to any of them.
We took the ten coins that made the biggest moves in our tracker on Monday, 5 October, and searched X for the earliest lure post carrying each coin's own contract address. Times below are from each post's own timestamp, and each coin's creation time is from Jupiter. X search doesn't index everything, so a lure could have come even earlier.
The answer: the lures don't chase a coin that's running. They find it at launch. $OWL's first lure came 5 minutes after the coin was created, $Instinct's 11 minutes after and $HIGGS's 25 minutes after. Seven of the ten were hit within 76 minutes. Every coin had lures days or hours before Monday's run, and the posts kept coming, minutes apart, before and after each run started. That reads as scheduled posting across every new coin, not a reaction to price.
The kits are shared. One set of posts sends people to look-alike "Moonshot" vote pages on netlify.app, reached through tinyurl links; a second sends them to numbered "fomo vote" pages on pages.dev. The same page addresses turn up on many coins, and both kinds ask visitors to connect a wallet. Moonshot [has said](https://x.com/moonshot/status/2061898490498646230) that "anyone telling you to vote, click a link, or send money to get verified is a scam."
Bigger coins got sites of their own. jeango.top, a "$JEANPHIL early users can claim their share" site, was registered on 25 September, six days after the coin launched, and pushed by copy-paste accounts during Monday's run ([our chatter](https://trenchbook.app/chatter#c48)). rewards-higgs.com, a "$HIGGS holder rewards dashboard", was registered at 8:14 AM ET Monday, about two and a half hours before the first post pushing it, and pushed by an account that copies Higgspad's bio ([our chatter](https://trenchbook.app/chatter#c47)). Neither coin's own accounts or DexScreener links mention a claim or a rewards dashboard. We couldn't load either site past its bot check.
Why does this work? A brand-new coin's holders are searching for news, a listing, anything that might send it higher. A "vote to list" or a "claim" fits exactly what they're hoping for, and the posts reach them at the moment they're most likely to click.
How to tell: a coin has a claim, a vote or a rewards dashboard only if its own X account and the links on its DexScreener profile say so. Moonshot says it doesn't run votes this way, and none of these coins' own channels pointed to one. Any vote, claim or verify page that asks you to connect a wallet is the tell. If you've connected a wallet to one, move what's left to a new wallet and revoke approvals you don't recognise.

## What we don't know

- Where the money from this round of vote pages goes: we have no victim reports from these coins yet.
- Who runs the lure kits, and whether the Moonshot-style and fomo-style kits are the same operator.
- What jeango.top and rewards-higgs.com ask for: both sit behind a bot check.

## The claims, checked

- "Holder rewards on $HIGGS now have a dashboard." (@Higgs_Solana_, 5 October): **unproven**. Higgspad's own account has posted about no such dashboard, and the site's domain was registered that morning. [The post](https://x.com/Higgs_Solana_/status/2107125477575987287) [Domain record](https://rdap.org/domain/rewards-higgs.com)
- "$JEANPHIL early users can claim their share while the allocation lasts." (Copy-paste X accounts, 5 October): **unproven**. Neither $JEANPHIL's DexScreener profile nor its X account mentions any claim. [One of the posts](https://x.com/TrenchSignalX/status/2107135066459484220) [Domain record](https://rdap.org/domain/jeango.top)

## The coins

- $OWL: `68AGsjomsgTtiTaDhF6XGCeVJDnFeh415ngYYgVxGzns` (Lure posts before its 5 Oct run)
- $Instinct: `8qfyGBXhN43m8nWcLeTVZVdCVyH554F5gpEWFBAYpump` (Lure posts before its 5 Oct run)
- $HIGGS: `DoVAVzViX8Bjy3r15nwikSaSbzE6dV4ovd28aWpJpump` (Lure posts before its 5 Oct run)
- $AIDEN: `9dSMwFfPezQ8WPcW1uZV7ns4rcviEj2LssSAg75WBLXd` (Lure posts before its 5 Oct run)
- $Attention+: `75gGuxuqKhQQiHae8JKDQaetK3XguKf1rUJ1csispump` (Lure posts before its 5 Oct run)
- $SPLICE: `7bC8ugu1ZJn21MhA4ht483nX8brLNesa8R7XLimpFyhq` (Lure posts before its 5 Oct run)
- $SWAP: `GYFLuEAZMDdpUsTmyGdHstuXQC3JB9ZqtZbfktpppump` (Lure posts before its 5 Oct run)
- $CALI: `8k4sBtEeK4pf26noKqApv8NBTnuSJcbdwpKYknk5PbAA` (Lure posts before its 5 Oct run)
- $JEANPHIL: `GTBxUiw6wJdmmkCGZgRHLyYxqu1vG4KtRpeox6yDpump` (Lure posts before its 5 Oct run)
- $Cadence: `46doJPsSjEVMsNZm4b32UbbvbUXjFTM3TDPBWMM3pump` (Lure posts before its 5 Oct run)

## Sources

- post: [First lure post naming $OWL](https://x.com/b0ns0nisETH/status/2106702539689283832)
- post: [First lure post naming $Instinct](https://x.com/Shamal_Blow/status/2107016747123716578)
- post: [First lure post naming $HIGGS](https://x.com/AzureOddityETH/status/2106728970070950272)
- post: [First lure post naming $AIDEN](https://x.com/tidebreakersnft/status/2106447484675326055)
- post: [First lure post naming $Attention+](https://x.com/Pelican_Vessel/status/2106668440681595230)
- post: [First lure post naming $SPLICE](https://x.com/MemeCoinCha/status/2106536554768556192)
- post: [First lure post naming $SWAP](https://x.com/bluwqksETH/status/2106834291967619297)
- post: [First lure post naming $CALI](https://x.com/neonkatzxyz/status/2100651909581291585)
- post: [First lure post naming $JEANPHIL](https://x.com/AstrynoxETH/status/2101717328475922648)
- post: [First lure post naming $Cadence](https://x.com/RugPullVet/status/2105489478542602587)
- post: [Moonshot's warning about vote scams, 2 June](https://x.com/moonshot/status/2061898490498646230)