moonshots-poll[.]fun

This domain, moonshots-poll.fun, poses a high-risk brand impersonation threat specifically targeting Moonshot, a recognized entity in the cryptocurrency or digital asset space. The domain was designed to deceive users by presenting itself as an official voting or listing platform under the guise of Moonshot, as evidenced by the page title 'Vote to List — Powered by Moonshot.' Such impersonation tactics are commonly employed to harvest credentials, distribute malware, or facilitate fraudulent transactions by exploiting the trust associated with the legitimate brand.

Infrastructure analysis reveals multiple indicators of malicious intent. The domain is flagged by 16 out of 95 security vendors on VirusTotal, a significant detection rate that underscores its suspicious nature. It appears on four distinct security blocklists and is actively blocked by multiple threat intelligence platforms. Registered on April 19, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to the IP address 104.21.64.58, which is proxied through Cloudflare, a common tactic to obfuscate the true origin of malicious infrastructure. Technologies detected include HSTS, Cloudflare Browser Insights, and HTTP/3, further indicating an attempt to mimic legitimate, secure platforms.

Users who visited moonshots-poll.fun should take immediate action to mitigate potential risks. If any credentials, wallet addresses, or personal information were entered on the site, they should be considered compromised and revoked or changed immediately. Affected users should scan their systems for malware using updated security tools and monitor financial or digital asset accounts for unauthorized transactions. Given the domain's high-risk classification and offline status, it is likely part of a broader campaign; users are advised to remain vigilant for similar impersonation attempts and verify the authenticity of any communications or platforms claiming affiliation with Moonshot.