list-moonshot[.]fun

This domain, list-moonshot.fun, operates as a brand impersonation platform specifically targeting users of the Moonshot cryptocurrency project. The site presents itself under the title 'Autism Coin – Moonshot Voting,' a misleading label designed to exploit trust in the Moonshot brand while introducing unrelated and potentially deceptive content. Analysis indicates the domain was likely created to distribute fraudulent investment schemes, fake token offerings, or crypto drainer scripts under the guise of official Moonshot voting or community engagement. The inclusion of terms like 'Autism Coin' suggests an attempt to manipulate emotional or social triggers to increase user interaction with malicious payloads or phishing forms. Evidence supporting the malicious classification includes detection by 7 out of 95 security vendors on VirusTotal, a Gridinsoft trust score of 0/100, and presence on three independent security blocklists. The domain was registered on March 05, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to IP address 172.67.161.184 and employs Cloudflare for traffic obfuscation, alongside modern web technologies such as Node.js, Vue.js, and Nuxt.js. These technical choices are consistent with threat actors seeking to evade detection while maintaining a professional appearance. Users who visited list-moonshot.fun should immediately revoke any connected wallet permissions, especially if they authorized transactions or interacted with smart contracts. Scan all devices used to access the site for malware using updated security tools. Monitor associated crypto wallets for unauthorized transactions and report any suspicious activity to relevant blockchain explorers or fraud reporting platforms. Reset credentials for any accounts accessed during the same browser session. Given the domain’s use of Cloudflare and modern JavaScript frameworks, browser-based crypto drainers may have executed silently—users should assume compromise if any interaction occurred.