moonshootvote[.]live

The domain moonshootvote.live was registered on 12 June 2026 through Global Domain Group LLC and is currently taken offline. DNS resolution points to the Cloudflare‑owned address 104.21.69.89, which belongs to AS13335 in the United States. The domain is served behind Cloudflare, uses HTTP/3 and presents a Google Trust Services / WE1 SSL certificate, indicating a valid TLS chain but offering no guarantee of legitimacy. Automated analysis identifies the presence of AngularJS and Cloudflare Browser Insights scripts, typical of many phishing kits that rely on client‑side rendering.

Threat intelligence attributes the site to a Seed Phrase Phishing kit, a toolset designed to solicit cryptocurrency recovery phrases from unsuspecting victims. VirusTotal has recorded eight positive detections out of ninety‑one scanners, and the domain is listed on three public blocklists. Additional blocklist providers—PhishDestroy, MetaMask, and SEAL—have explicitly blocked the domain, reinforcing its malicious classification. Because the site is offline, no page title, content snapshot, or Safe Browsing verdict is available, leaving the exact phishing landing page unknown.

Nevertheless, the combination of recent registration, Cloudflare‑based hosting, a valid TLS certificate, and the Seed Phrase Phishing kit strongly suggests an active credential‑stealing campaign targeting cryptocurrency users. Defenders should add moonshootvote.live to internal deny lists, monitor the 104.21.69.89 IP for any future re‑hosting activity, and enforce proxy or gateway filtering that recognizes the Seed Phrase Phishing pattern. Continuous re‑query of public blocklists and VT scans is advised to capture any re‑activation, and any observed attempts to resolve the domain should be logged for incident response.