moonlisting[.]best

Analysis indicates that moonlisting.best was used in a brand_impersonation campaign designed to mimic a legitimate project and attract user interaction through a page titled "KOL – Vote to list on Moonshot". Such operations commonly attempt to build trust through visual imitation and persuasive messaging, creating opportunities for credential theft, wallet compromise, account takeover, or other forms of social engineering. Although the site is currently offline, historical indicators suggest elevated risk and justify continued monitoring of related infrastructure.

Technical evidence supports the classification. The domain was created on June 15, 2026 and was registered through Global Domain Group LLC. Security telemetry shows that 7 of 95 security vendors flagged the domain, and the infrastructure appeared on 4 security blocklists. Historical resolution data links the domain to IPv6 address 2a06:98c1:3121::3. Certificate records indicate use of an SSL certificate issued through Google Trust Services. The combination of recent registration, brand-focused presentation, detection activity, and blocklist presence increases confidence in the assessment.

Users who interacted with the site should treat the exposure as potentially unsafe. Any credentials, recovery phrases, authentication tokens, or sensitive information entered during a visit should be considered at risk. Recommended actions include changing affected passwords, rotating authentication secrets, reviewing account activity for unauthorized access, revoking active sessions where applicable, and monitoring for unusual transactions or login attempts. Security teams should preserve relevant logs, search for related indicators across their environment, and block any remaining references to the domain. Even though the site has been taken offline, residual links, cached content, or successor domains may continue to circulate.