moonshot-votes[.]app

This domain, moonshot-votes.app, is identified as a brand impersonation phishing site currently offline. The threat specifically targets Moonshot, a recognized entity in the cryptocurrency or technology sector, by falsely presenting itself as an official voting or listing platform under the guise of Moonshot’s branding. The page title, 'Vote to List — Powered by Moonshot,' directly leverages the brand’s name to deceive users into engaging with the malicious content. Analysis of the domain reveals multiple technical indicators of compromise. The domain is flagged by 6 of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its malicious nature. It was registered through Cloudflare, Inc., a registrar frequently utilized for both legitimate and malicious domains due to its privacy and proxy services. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3, which may be part of a broader hosting infrastructure used for phishing campaigns. The domain appears on 2 security blocklists, further corroborating its classification as a threat. Additional scrutiny of the domain’s metadata or historical DNS records may reveal patterns consistent with phishing operations, such as short-lived registrations or rapid changes in hosting providers. As of the latest assessment, moonshot-votes.app has been taken offline, reducing immediate exposure to end users. However, the infrastructure associated with this domain may remain active or be repurposed for future campaigns. Organizations and individuals are advised to proactively block the domain and its associated IP address (188.114.96.3) at the network level to prevent potential re-emergence. Security teams should monitor for similar domains leveraging the Moonshot brand, particularly those using variations of 'vote,' 'listing,' or 'powered by' in their naming conventions. End users should be educated on the risks of brand impersonation, especially in the context of cryptocurrency or token-related activities, and encouraged to verify the authenticity of platforms through official channels before interaction.