moonshootvote[.]fun

This domain, moonshootvote.fun, is identified as a high-risk phishing operation targeting cryptocurrency users through a deceptive "Pump" scheme. Analysis indicates the domain is designed to mimic legitimate crypto promotion or token launch pages, likely deploying a wallet drainer kit to harvest credentials or private keys. The page title "Pump" suggests an attempt to exploit trending crypto narratives, such as token pumps or airdrops, to lure victims into connecting their wallets to malicious smart contracts or fake interfaces. No direct brand impersonation is evident, but the tactic aligns with common phishing campaigns leveraging FOMO (fear of missing out) in the crypto space.

Technical indicators confirm the domain's malicious nature. Registered on April 20, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to the IP address 188.114.96.3, hosted behind CloudFlare infrastructure in Canada. VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious, while it appears on four security blocklists. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its ease of acquisition. No Google Safe Browsing (GSB) status is provided, but the domain has been proactively blocked by multiple independent security entities.

As of the latest assessment, moonshootvote.fun has been taken offline, likely in response to detection and reporting by security vendors. However, the infrastructure remains a residual risk. The registrar, PDR Ltd., has been frequently associated with abusive domains, and the use of CloudFlare may have obscured additional hosting details. Users who interacted with the domain prior to its takedown should assume potential credential or fund compromise, particularly if wallet connections were established. Recommendations include revoking permissions for any connected smart contracts, monitoring wallet activity for unauthorized transactions, and verifying the legitimacy of any crypto-related promotions before engagement. The domain's creation date in 2026 suggests either a typo or an attempt to evade time-based detection heuristics, warranting continued vigilance against similar campaigns.