moonslogin[.]co

This domain, moonslogin.co, is flagged as a high-risk brand impersonation threat designed to deceive users by mimicking the legitimate Moonshot platform. Analysis indicates the site operates under the pretense of a voting mechanism titled 'KOL – Vote to list on Moonshot,' a common tactic to lure victims into interacting with fraudulent infrastructure. The domain exhibits characteristics consistent with phishing operations targeting cryptocurrency users, leveraging social engineering to exploit trust in the impersonated brand. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain resolves to the IP address 104.21.11.174 and is registered through Global Domain Group LLC, with a creation date of June 17, 2026, suggesting a recently established operation. Security vendors on VirusTotal flag the domain at a ratio of 15/95, indicating moderate to high detection rates. The site appears on three security blocklists and is actively blocked by multiple browser-based security extensions. The SSL certificate is issued by Google Trust Services, which, while providing encryption, does not validate the legitimacy of the site’s content or intent. Mitigation steps for this threat type include immediate blacklisting of the domain and associated IP address within enterprise and consumer security tools. Organizations should update their email and web filtering rules to block any references to moonslogin.co, including embedded links or redirects. Users who may have interacted with the site should be advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and reset credentials for any accounts associated with the impersonated platform. Given the domain’s current offline status, continuous monitoring for reactivation or rebranding attempts is recommended, as threat actors frequently reuse infrastructure under new domains.