moonshot-vote[.]sbs

This domain, moonshot-vote.sbs, is flagged for brand impersonation targeting Moonshot, a recognized entity in the digital asset sector. The threat type involves presenting a fraudulent voting interface titled 'KOL – Vote to list on Moonshot,' designed to deceive users into interacting with a counterfeit platform. No direct evidence of a crypto drainer kit is observed, but the impersonation tactic suggests an intent to harvest credentials or manipulate user actions under false pretenses. Analysis indicates the domain was registered through Global Domain Group LLC on March 03, 2026, and resolves to the IP address 104.21.1.12, hosted by a content delivery network provider in Canada. The domain appears on one security blocklist, and VirusTotal reports 11 out of 95 security vendors flagging it as malicious. The SSL certificate is issued by Let's Encrypt, a common but not inherently suspicious provider. No entries are found in Google Safe Browsing at the time of analysis, though this does not preclude prior or future detections. The domain has been taken down, reducing immediate risk to users. However, residual threats may persist through cached pages, phishing emails, or secondary domains leveraging similar impersonation tactics. Users are advised to verify platform authenticity through official channels and avoid interacting with unsolicited voting or listing prompts. Organizations should monitor for related domains registered under the same registrar or resolving to identical infrastructure, as these may indicate follow-up campaigns.