moonshoot-vote[.]live

This domain, moonshoot-vote.live, poses a high-risk brand impersonation threat targeting users of the Moonshot platform. The site presents a fraudulent "KOL – Vote to list on Moonshot" page, designed to deceive visitors into participating in a fake voting mechanism. Analysis indicates the infrastructure is engineered to harvest credentials, personal data, or cryptocurrency-related information under the guise of a legitimate Moonshot community engagement feature. The domain specifically exploits the trust associated with Moonshot’s branding to execute social engineering attacks against users unfamiliar with official communication channels. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on June 15, 2026, through Global Domain Group LLC, a registrar frequently associated with suspicious registrations. It resolves to the IP address 172.67.174.27 and has been flagged by 15 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. Additionally, the domain appears on four distinct security blocklists, including MetaMask, PhishDestroy, SEAL, and Maltrail, further corroborating its classification as a phishing resource. The page title, "KOL – Vote to list on Moonshot," directly mimics legitimate promotional campaigns, increasing the likelihood of user deception. Users who visited moonshoot-vote.live should take immediate remedial actions to mitigate potential compromise. If any credentials, wallet addresses, or personal information were entered on the site, affected users must revoke access to any linked accounts, rotate passwords, and enable multi-factor authentication where available. Cryptocurrency wallet users should transfer assets to a new wallet and monitor for unauthorized transactions. System scans using updated security tools are recommended to detect any secondary payloads or malware. Organizations should update internal blocklists to include this domain and its associated IP address, while users should report the incident to relevant security teams for further analysis and response.