community-voting[.]xyz

This domain is flagged as an elevated-risk brand impersonation threat designed to deceive users of the Moonshot platform. The site mimics legitimate voting or listing pages, potentially harvesting credentials or facilitating unauthorized transactions under the guise of community engagement. Analysis indicates this is not a generic phishing attempt but a targeted impersonation of Moonshot’s branding and functionality. Infrastructure analysis reveals the domain community-voting.xyz was registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3 and is currently offline. The domain appears on four security blocklists and is actively blocked by multiple detection systems. VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. Detected technologies include HSTS, Cloudflare Browser Insights, Cloudflare, and HTTP/3, suggesting an attempt to appear legitimate through modern web standards. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP (188.114.97.3) at the network perimeter. Organizations should update endpoint protection rules to flag any attempts to access community-voting.xyz or related subdomains. Users who may have interacted with the site should be instructed to reset credentials, particularly for Moonshot-related accounts, and enable multi-factor authentication where available. Security teams should monitor for unusual transaction patterns or unauthorized access attempts linked to this campaign, as brand impersonation often precedes credential theft or financial fraud.