moonlisting[.]shop

This domain, moonlisting.shop, is a confirmed phishing site that was taken offline as of July 23, 2026. It impersonated the brand Moonshot, as indicated by the page title 'KOL – Vote to list on Moonshot', which suggests a fraudulent voting or listing scheme targeting cryptocurrency or decentralized project users. The domain was registered through Global Domain Group LLC and hosted on Cloudflare infrastructure (AS13335, IP 188.114.97.3, located in the US). Security scanning on VirusTotal flagged the domain as malicious by 8 out of 91 vendors, and it appeared on three security blocklists including PhishDestroy, MetaMask, and SEAL.

AlienVault OTX recorded one threat intelligence pulse referencing this domain. The SSL certificate was issued by Google Trust Services (WE1), which is a legitimate certificate authority, but this does not indicate safety of the content. The Gridinsoft trust score of 0/100 confirms high risk.

Technologies detected include AngularJS, Cloudflare Browser Insights, and HTTP/3, indicating a modern, interactive phishing page. Defenders should block this domain at the DNS and email gateway levels, monitor for related subdomains or variations of 'moonlisting', and investigate the threat intelligence pulse on OTX for broader campaign indicators. While the site is offline, the infrastructure and registration details remain valuable for tracking associated threat actors.