moonshot-vote-grimdoge[.]fun

This domain, moonshot-vote-grimdoge.fun, is identified as a brand impersonation threat targeting Moonshot, a known cryptocurrency platform. Analysis indicates the site was designed to deceive users into believing they are interacting with official Moonshot services, likely for the purpose of credential theft or fraudulent token transfers. No specific drainer kit signatures have been confirmed, but the domain exhibits characteristics consistent with crypto-focused social engineering campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 30, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 172.67.151.1, a host that may be associated with content delivery networks or proxy services. The domain is flagged by 14 out of 95 security vendors on VirusTotal, and it appears on two independent security blocklists. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. As of the latest verification, the domain does not appear on Google Safe Browsing (GSB) blocklists, though this may reflect a lag in detection rather than benign status. The domain has been taken offline, reducing immediate risk to users. It was previously blocked by multiple security feeds, including both commercial and community-driven threat intelligence platforms. Despite its current inactive state, residual risk remains for organizations or individuals who may have cached DNS records, saved links, or received prior phishing communications referencing this domain. Users who interacted with the site before its takedown should assume potential exposure of credentials or wallet addresses and take remediation steps, including revoking active sessions, rotating passwords, and monitoring for unauthorized transactions. Security teams are advised to add the domain and associated IP to internal blocklists as a precautionary measure.