moonslogin[.]one

This domain, moonslogin.one, poses a high-risk brand impersonation threat targeting users of the Moonshot platform. Analysis indicates the site masquerades as an official voting portal for token listing events, using the page title 'KOL – Vote to list on Moonshot' to deceive visitors into submitting credentials or transferring assets. The fraudulent infrastructure is designed to exploit trust in the Moonshot brand, likely aiming to harvest sensitive information or facilitate unauthorized transactions under the guise of a legitimate community governance process. Infrastructure analysis reveals multiple indicators of malicious activity. The domain was registered on June 17, 2026, through Global Domain Group LLC, a registrar frequently associated with suspicious registrations. It resolves to the IP address 172.67.136.95 and is flagged by 15 out of 95 security vendors on VirusTotal. Additionally, the domain appears on three security blocklists and is actively blocked by multiple detection systems. The SSL certificate issued by Google Trust Services does not mitigate the risk, as the underlying content remains malicious. Users who visited moonslogin.one should immediately revoke any permissions granted to the site, reset credentials for associated accounts, and monitor for unauthorized transactions. If financial or sensitive data was submitted, affected parties should report the incident to relevant platforms and consider additional protective measures, such as enabling multi-factor authentication and reviewing connected applications for signs of compromise. The domain has since been taken offline, but similar threats may persist under different addresses.