moonshot[.]vote-gateway[.]net

This domain, moonshot.vote-gateway.net, is flagged for brand impersonation targeting Moonshot, a recognized entity in the cryptocurrency or digital asset sector. Analysis indicates the site is designed to deceive users by mimicking the legitimate brand’s interface, likely aiming to harvest credentials or facilitate unauthorized transactions. No direct evidence of a crypto drainer kit has been observed, but the domain’s structure and content align with known brand impersonation tactics used in credential theft campaigns.

Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). It was registered through Tucows Domains Inc. on February 21, 2026, an anomalous creation date suggesting potential domain spoofing or backdating. The domain is flagged by 9 out of 95 security vendors on VirusTotal, and it appears on two independent security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious sites leveraging Cloudflare’s infrastructure. No Google Safe Browsing (GSB) detection is currently recorded, though this may reflect a lag in propagation rather than absence of risk.

As of the latest assessment, the domain remains active and unresolved by the registrar or hosting provider. The page title, 'Suspected phishing site | Cloudflare,' suggests Cloudflare’s internal detection systems have also flagged the domain, though no takedown or mitigation has been enforced. Given the elevated risk level, users are advised to treat this domain as hostile and avoid interaction. Organizations should update blocklists to include this domain and its associated IP, while monitoring for related infrastructure that may emerge under similar naming conventions or registrar patterns.