vote[.]moonshott[.]app

This domain, vote.moonshott.app, poses a brand impersonation threat targeting Celer, a blockchain interoperability protocol. The site presents itself as a "Vote to List" platform under the guise of a legitimate community governance initiative, likely designed to deceive users into engaging with fraudulent proposals or disclosing sensitive information. Such impersonation tactics are commonly used to exploit trust in decentralized projects, potentially leading to unauthorized access to crypto wallets or the dissemination of malicious smart contracts under the pretense of official voting mechanisms.

Analysis of the domain reveals multiple technical indicators of malicious intent. The domain was registered on December 14, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while infrastructure analysis shows it resolves to the IP address 188.114.97.3. Additionally, the domain appears on one security blocklist and has been proactively blocked by at least one threat intelligence platform. The page title, "Vote to List — Powered by Moonshot," further suggests an attempt to mimic legitimate project branding.

Users who visited vote.moonshott.app should take immediate action to mitigate potential risks. If any interaction occurred, such as connecting a wallet or submitting credentials, revoke all active smart contract approvals associated with the domain using a blockchain explorer or wallet security tool. Monitor connected accounts for unauthorized transactions and consider rotating passwords or private keys if sensitive data was exposed. Report the domain to relevant security teams, such as the impersonated project’s official channels, to aid in broader threat mitigation efforts. Exercise caution with similar domains promoting governance votes or airdrops, verifying authenticity through official project documentation before engagement.