moonjoin[.]club

Analysis confirms that moonjoin.club was registered on June 22, 2026 through Global Domain Group LLC and immediately pointed at the Cloudflare edge network (AS13335) in the United States, resolving to 172.67.185.174. The site delivered an SSL certificate issued by Google Trust Services under the WE1 root, indicating a legitimate‑looking HTTPS endpoint. Page metadata revealed the title “KOL – Vote to list on Moonshot,” matching the brand target Moonshot and confirming the intent to impersonate that project.

The underlying front‑end was built with AngularJS and served over HTTP/3, with Cloudflare Browser Insights scripts present, consistent with a typical phishing kit that harvests cryptocurrency seed phrases. Intelligence feeds identified the kit as “Seed Phrase Phishing.” The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that defensive products have already incorporated the indicator. AlienVault OTX references the domain in a single pulse, and VirusTotal recorded three detections out of ninety‑one scanners, further corroborating malicious intent.

Although the site has been taken offline at the time of reporting, the infrastructure—particularly the Cloudflare IP and the Google‑issued TLS certificate—may be reused for future campaigns. Defenders should add the fully qualified domain name and its resolved IP to inbound and outbound allow/deny lists, monitor DNS query logs for look‑ups, and ensure that any wallet or authentication solutions block interactions with URLs containing “moonjoin.club” or similar patterns. Continuous threat‑intel feeds should be consulted for re‑hosting attempts, and any detection rules that rely on the observed page title or AngularJS fingerprint should be updated to maintain coverage.