moonshootvotes[.]fun

PhishDestroy identifies moonshootvotes.fun as a generic phishing domain hosting a crypto-currency drainer kit designed to steal wallet credentials and assets. The site masquerades as a legitimate voting portal, likely targeting users expecting governance or ballot participation. No direct brand impersonation was observed in seed ee5f3a, but the fraudulent voting theme is consistent with crypto-draining operations.

This domain was flagged under seed ee5f3a with VirusTotal showing 0 detections out of 95 scanners at the time of analysis. It is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IPv4 address 188.114.96.3. The domain was created on March 28, 2026, and holds a valid Let's Encrypt SSL certificate. Google Safe Browsing (GSB) has not yet blacklisted this domain, and no public blocklists were found to include it as of the latest scan.

The domain remains active and unblocked, posing an ongoing risk to visitors who may be lured via social engineering or phishing campaigns. Immediate defensive actions include domain blocking at the network perimeter and user awareness training to avoid interactions with unsolicited voting-related links. While no malicious payload has been confirmed beyond the drainer kit, the combination of recent registration, low detectability, and active infrastructure elevates the risk profile. Users are advised to verify any voting portal URL using PhishDestroy before entering credentials or connecting wallets.