moontok-listings[.]vote

This domain, moontok-listings.vote, was assessed as a high-risk brand impersonation threat specifically targeting users of the Moonshot platform. The site masquerades as an official voting page for token listings, a common tactic used to harvest credentials or cryptocurrency wallet access from unsuspecting victims. While the domain is currently offline, the threat it posed was significant due to its convincing replication of Moonshot's branding and purpose.

PhishDestroy's investigation uncovered several damning indicators. VirusTotal flagged the domain with 13 out of 95 security vendors marking it as malicious, and it appeared on three security blocklists. The domain was created on April 22, 2026, and registered through Dynadot Inc, resolving to IP address 172.67.214.82. Its SSL certificate was issued by Let's Encrypt (E7), providing a false sense of security. AlienVault OTX recorded it in one threat intelligence pulse, linking it to ongoing phishing campaigns. The page title, 'Vote to List — Powered by Moonshot,' directly mimicked the legitimate Moonshot interface.

Users should remain vigilant against similar scams by always verifying URLs through official channels. Moonshot users should never click on unsolicited voting links and should report suspected phishing domains to the platform. If credentials were entered on this site, immediate password changes and two-factor authentication resets are critical. Monitoring for unauthorized transactions or account access is also advised, as such phishing sites often aim to steal wallet keys or login details.