moonshots-voting[.]top

This domain is flagged as a high-risk brand impersonation threat targeting Moonshot, a recognized entity in the cryptocurrency or decentralized application space. Analysis indicates the domain was designed to deceive users by mimicking legitimate voting or listing processes under the guise of Moonshot’s branding, as evidenced by the page title 'Vote to List — Powered by Moonshot.' The intent appears to be credential harvesting, unauthorized transaction solicitation, or distribution of malicious payloads under false pretenses.

Infrastructure analysis reveals the domain was registered on June 14, 2024, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.25.108, a Cloudflare-protected endpoint leveraging HTTP/3, Node.js, Vue.js, and Nuxt.js for frontend rendering. The domain has been detected by 18 out of 95 security vendors on VirusTotal and appears on three independent security blocklists. Additional detections include automated blocking by browser-based transaction security tools and a Gridinsoft trust score of 0/100, indicating no baseline legitimacy. The domain is currently offline, though historical activity suggests it may have been operational during a targeted campaign.

Mitigation steps for this specific threat type include immediate blacklisting of the domain and its resolving IP across all network security controls, including firewalls, DNS filters, and endpoint protection systems. Organizations should monitor for residual phishing attempts referencing 'Vote to List' or Moonshot branding in email, social engineering, or decentralized application contexts. Security teams are advised to review logs for connections to 104.21.25.108 or related Cloudflare IP ranges during the domain’s active period. User awareness training should emphasize the risks of interacting with unsolicited voting or listing prompts, particularly those leveraging cryptocurrency or token-based incentives. If credentials or wallet interactions were exposed, affected parties should revoke access, rotate keys, and audit transaction histories for unauthorized activity.