getmoonvote[.]fun

Analysis of the domain getmoonvote.fun indicates it was actively involved in brand impersonation targeting Celer, a known blockchain interoperability platform. The domain was registered on February 27, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and resolved to the IP address 188.114.96.3, associated with Cloudflare, Inc. (AS13335) in the United States. No SSL certificate was detected for this domain, increasing the risk of unencrypted data transmission. The page title, 'Vote to List — Powered by Moonshot,' suggests an attempt to mimic a legitimate voting or listing mechanism, likely leveraging the Celer brand to deceive users. Infrastructure analysis reveals the domain was hosted on Cloudflare nameservers (benedict.ns.cloudflare.com and coraline.ns.cloudflare.com), a common tactic to obscure hosting origins and evade detection.

At the time of assessment, the domain was flagged by one of 93 security vendors on VirusTotal and appeared on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. The domain is currently offline, though its prior activity and infrastructure warrant continued monitoring. Defenders should treat this domain as part of a broader phishing campaign impersonating Celer.

Blocklist integration is recommended for organizations utilizing Celer-related services or blockchain platforms. Given the use of Cloudflare infrastructure, additional scrutiny of domains resolving to similar IPs or nameservers may uncover related threats. The absence of SSL and the domain's rapid inclusion on multiple blocklists suggest a deliberate attempt to exploit trust in the Celer brand, likely for credential harvesting or fraudulent transactions. Further investigation into the 'Moonshot' reference in the page title may provide additional context on the campaign's scope or objectives.