promote-moonshot[.]xyz

The domain promote-moonshot.xyz has been identified as a brand impersonation threat targeting Moonshot, a known entity in the cryptocurrency sector. This domain is currently offline but was previously active in fraudulent activities, specifically masquerading as an official Moonshot token voting platform. The page title, 'Moonshot – Vote for your token to get listed!', suggests an attempt to deceive users into participating in a fabricated voting process, likely to harvest sensitive information or cryptocurrency assets. Analysis of the domain reveals several critical technical indicators. The domain was registered on March 12, 2026, through Name.com, Inc., and resolved to the IP address 216.150.1.1, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. VirusTotal reports that 10 out of 95 security vendors flagged this domain as malicious, indicating a moderate to high level of detection consensus. Additionally, the domain appears on one security blocklist, further corroborating its association with fraudulent activities. The combination of these indicators, including the recent creation date and low trust scores, underscores the elevated risk posed by this infrastructure. As the domain is currently offline, immediate threats to end users are mitigated. However, the infrastructure may resurface under a different domain or IP address, necessitating continued vigilance. Organizations and individuals are advised to monitor for similar domains registered through the same registrar or resolving to the identified IP range. Blocking access to the domain and its associated IP address at the network level is recommended as a preventive measure. Users should be educated on recognizing brand impersonation tactics, particularly in the cryptocurrency space, and encouraged to verify the authenticity of platforms through official channels before engaging with any token-related activities.