moonvote[.]space

This domain, moonvote.space, is identified as a crypto wallet drainer phishing site designed to compromise digital asset wallets by tricking users into authorizing malicious transactions. The threat leverages social engineering tactics, such as fake token airdrops or governance proposals, to prompt victims into connecting their wallets to the domain, where automated scripts then siphon funds to attacker-controlled addresses. Infrastructure analysis reveals the domain mimics legitimate decentralized finance (DeFi) platforms, increasing the likelihood of successful exploitation among users familiar with such services. Analysis indicates the domain was registered on June 07, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. Despite its recent creation, the domain has already been flagged by 4 security blocklists, including MetaMask and PhishDestroy, though it remains undetected by VirusTotal (0/95 engines). The domain resolves to IP address 188.114.97.3, which has been linked to other phishing campaigns targeting cryptocurrency users. The absence of detections on VirusTotal suggests the domain employs evasion techniques, such as dynamic content loading or obfuscated scripts, to bypass automated analysis. Users who visited moonvote.space or interacted with its content should immediately revoke any wallet authorizations granted to the domain using a blockchain explorer or wallet management tool. All connected wallets should be audited for unauthorized transactions, particularly those involving token approvals or fund transfers. If funds were lost, victims are advised to report the incident to relevant blockchain analytics platforms and law enforcement agencies with jurisdiction over cybercrime. Additionally, users should monitor their wallets for suspicious activity and consider migrating assets to a new wallet if compromise is confirmed.