moonshot-polling[.]live

PhishDestroy identifies www.moonshot-polling.live as an active brand impersonation domain targeting Moonshot. The domain is currently under investigation for impersonating the Moonshot brand to deceive users into engaging with fraudulent polling activities. This campaign is classified as a high-risk threat due to its active status and lack of detection by security vendors.

This domain was flagged by 11 out of 95 VirusTotal vendors, indicating a low detection rate despite its malicious intent. It resolves to IP address 216.150.1.193 and operates under a valid Let’s Encrypt SSL certificate, which may lend it an air of legitimacy. The domain’s registration details, including the registrar and creation date, remain unverified at this stage, but its association with a recently observed phishing campaign targeting Moonshot users underscores its malicious nature. The absence of blocklist entries and low trust scores further elevate the risk of user exposure to this threat.

As of this report, www.moonshot-polling.live remains an active threat, with no mitigations in place. Users are strongly advised to avoid interacting with this domain and to report any encountered phishing attempts to Moonshot’s security team. Organizations should consider blocking the domain at the network level and updating threat intelligence feeds to prevent further exposure. Immediate action is recommended to mitigate potential fraud and protect users from credential theft or financial loss.