moonvoteshot[.]com

This domain, moonvoteshot.com, is currently flagged as an active high-risk phishing operation specifically designed to harvest decentralized finance (DeFi) wallet credentials and private keys. Analysis indicates the site impersonates legitimate cryptocurrency platforms to deceive users into disclosing sensitive authentication details. The threat type is classified as credential phishing with financial fraud objectives, targeting users of blockchain-based applications. Infrastructure analysis reveals the domain was registered on June 16, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, an uncommon registrar for legitimate financial services. It resolves to IP address 104.21.93.164, which is protected by Cloudflare infrastructure, obscuring the true origin server. The domain appears on three security blocklists and is flagged by 16 of 95 security vendors in aggregated scanning platforms. A Gridinsoft trust score of 0/100 further corroborates malicious classification. The SSL certificate is issued by Google Trust Services, providing a false sense of security while the underlying content remains fraudulent. Detected technologies include HTTP/3 protocol support, indicating modern infrastructure used to evade traditional detection mechanisms. Current assessment confirms the domain remains operational and poses an immediate risk to users of decentralized applications. Users are strongly advised to block all connections to 104.21.93.164 and moonvoteshot.com at the network level. Security teams should update web filtering rules to include this domain and associated IP in deny lists. End-users who may have interacted with the site should immediately revoke any active sessions, rotate credentials, and monitor connected wallet addresses for unauthorized transactions. Organizations handling cryptocurrency transactions should implement additional verification steps for any communication referencing this domain or similar infrastructure patterns.