tops-moonshot[.]pages[.]dev

This domain is flagged for brand impersonation, specifically targeting Moonshot, a recognized entity in the cryptocurrency ecosystem. Analysis indicates the site was designed to deceive users by mimicking Moonshot’s branding, as evidenced by the page title 'Vote to List — Powered by Moonshot,' which aligns with common tactics used to exploit trust in legitimate platforms. The threat type is confirmed as brand impersonation, with no evidence of credential theft or crypto drainer functionality at this stage, though further investigation is warranted given the domain’s recent offline status. Infrastructure analysis reveals the domain tops-moonshot.pages.dev resolves to the IP address 172.66.47.161 and was registered on February 26, 2026, through Cloudflare, Inc. Despite its recent creation, the domain has already been added to three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. VirusTotal reports zero detections out of 95 engines (0/95), though this lack of flagging does not preclude malicious intent, particularly given the domain’s Gridinsoft trust score of 0/100. The SSL certificate is issued by Let’s Encrypt, and the site employs technologies such as Unpkg, HSTS, Cloudflare, and HTTP/3, which are consistent with both legitimate and malicious infrastructure. Mitigation steps for brand impersonation threats of this nature include immediate domain takedown requests to the hosting provider, leveraging the registrar’s abuse reporting mechanisms, and notifying the targeted brand (Moonshot) for further action. Organizations should update their security blocklists to include this domain and its associated IP address (172.66.47.161) to prevent access. Users who may have interacted with the domain should be advised to monitor for unauthorized activity, particularly in cryptocurrency wallets or accounts linked to Moonshot. Given the domain’s offline status, continuous monitoring for re-emergence under similar infrastructure or branding is recommended.