moonshoot-vote[.]xyz

Analysis conducted on July 24, 2026 identifies moonshoot-vote.xyz as a high‑risk brand‑impersonation infrastructure targeting the cryptocurrency platform Moonshot. The domain was registered on June 15, 2026 through Global Domain Group LLC and is hosted on Cloudflare’s network (ASN 13335) with the authoritative nameservers chelsea.ns.cloudflare.com and weston.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which is geolocated to the United States and is part of Cloudflare’s edge infrastructure. The site presented the page title “KOL – Vote to list on Moonshot,” directly referencing the targeted brand, and employed a Google Trust Services / WE1 SSL certificate, a common credential for abuse of reputable TLS issuers.

Malware analysis links the site to a Seed Phrase Phishing kit, indicating an attempt to harvest private‑key recovery phrases from Moonshot users. Threat intelligence feeds have flagged the domain on three security blocklists, and it is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans recorded 10 detections out of 91 security vendors, reinforcing the malicious classification. The Gridinsoft trust score of 0 / 100 reflects an extremely low reputation.

Current HTTP checks show the site is offline, preventing further live interaction, but the historical evidence remains sufficient for remediation. Defenders should add moonshoot‑vote.xyz to network‑level deny lists, enforce URL filtering, and monitor Cloudflare‑associated IP ranges for re‑hosting attempts. Given the use of a reputable SSL certificate, TLS inspection policies should be reviewed to detect similar content despite encrypted transport. Continuous observation of newly registered domains that reference “Moonshot” or employ the same nameserver pair is recommended to pre‑empt future impersonation campaigns.