# PhishDestroy threat dossier — moonshot-listings.vote ================================================================ Fetched: 2026-04-26 05:09:14 UTC Canonical: https://phishdestroy.io/domain/moonshot-listings.vote/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Moonshot Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 2/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 12/94 security vendors flagged this domain Flagging vendors: Kaspersky ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 Registrar: Dynadot Inc Nameservers: penny.ns.cloudflare.com, scott.ns.cloudflare.com Registered: 2026-04-24 Expires: 2027-04-24 Page title: Vote to List — Powered by Moonshot HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E8 Expires: 2026-07-23 Status: INVALID chain Fingerprint: 6996a68364e2131f3acadd1961f1a75c157d80feae4e899b35497469f7949bef ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-24 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-25 21:21:09 UTC (by PhishDestroy tracker) First reported: 2026-04-25 18:23:19 UTC (abuse notice filed) Last verified: 2026-04-26 07:40:01 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dc5de-3eae-743a-ac1b-a4334392d0cd/ URLQuery: https://urlquery.net/report/f921e963-05ba-4048-9471-cf11d052e504 Wayback Machine: https://web.archive.org/web/*/moonshot-listings.vote crt.sh CT logs: https://crt.sh/?q=%25.moonshot-listings.vote Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=moonshot-listings.vote AlienVault OTX: https://otx.alienvault.com/indicator/domain/moonshot-listings.vote URLhaus: https://urlhaus.abuse.ch/host/moonshot-listings.vote/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-25 21:21:46 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy’s investigation flags moonshot-listings.vote as an active brand impersonation scam designed to mislead users by exploiting the Moonshot brand. This domain was registered on April 24, 2026, and is hosted on IP 188.114.97.3 through Dynadot Inc, leveraging a Let’s Encrypt SSL certificate to appear legitimate. While it currently evades detection tools like VirusTotal (0/95 detections), its suspicious naming pattern and recent creation date raise immediate red flags for potential fraud or phishing activities targeting unsuspecting visitors. The core threat posed by moonshot-listings.vote is brand impersonation, where attackers create domains that closely resemble trusted brands—in this case, Moonshot—to deceive users into sharing sensitive information, downloading malware, or engaging in financial transactions. The domain’s structure (moonshot-listings.vote) mirrors legitimate services but intentionally replaces the .com or .org extension with .vote, a tactic often used to bypass traditional security filters. The 0/95 VirusTotal detection rate suggests this domain is still in its early, low-profile phase, but its rapid classification as a brand impersonation scam by PhishDestroy underscores the urgency to treat it as high-risk until proven otherwise. If you’ve visited moonshot-listings.vote, immediately scan your device with updated antivirus software and review recent transactions or data inputs for signs of compromise. Avoid entering any personal, financial, or login credentials on this site, as the domain’s impersonation could lead to credential theft or malware distribution. Report the domain to your cybersecurity team or use tools like PhishDestroy’s blocklist to prevent future access. Monitor accounts closely for unusual activity and consider resetting passwords for services linked to Moonshot or similar brands. Stay vigilant against similar domains, especially those with recent registration dates or unusual extensions like .vote. [Updates since narrative was generated:] - VirusTotal detections: now 12/94 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260425-A35925 Favicon MD5: c011c4183fccc9e1bd2c1e82d01f63fe TLS cert SHA-256: 6996a68364e2131f3acadd1961f1a75c157d80feae4e899b35497469f7949bef ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/moonshot-listings.vote/ JSON API: https://api.destroy.tools/v1/check?domain=moonshot-listings.vote Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io