moonshot-vote[.]info

Analysis of the domain moonshot-vote.info, reported on 25 July 2026, indicates that the site was used for a brand‑impersonation campaign targeting the Moonshot brand and classified as a crypto‑scam. The domain resolves to the IP address 172.67.163.139, which belongs to the Cloudflare network (AS13335) and is located in the United States. DNS records show the authoritative name servers jade.ns.cloudflare.com and venkat.ns.cloudflare.com, both operated by Cloudflare, and the registration was performed through Cloudflare, Inc. No TLS certificate was observed, implying that the site was served over plain HTTP. The page title returned by the server is “Moonshot”, matching the advertised brand target. The domain has been listed on two public blocklists and is currently blocked by the PhishDestroy and ScamSniffer services.

VirusTotal reports indicate that the URL was scanned by 95 antivirus engines, none of which raised a detection at the time of analysis; this absence of detections does not constitute proof of safety. Both PhishDestroy and ScamSniffer have marked the domain as malicious, confirming its inclusion in threat intelligence feeds. The operational status of moonshot‑vote.info is recorded as offline, suggesting that the phishing infrastructure has been taken down or is temporarily inactive. However, the underlying Cloudflare hosting and registrar information remain unchanged, which could allow rapid re‑deployment of the same domain or an associated sub‑domain. No additional evidence such as malicious payload hashes, phishing kits, or URL redirects is available in the current intelligence set.

Defenders should continue to block traffic to 172.67.163.139 and to the domain moonshot‑vote.info at network and DNS layers. Monitoring of the registrar and name‑server records is advised to detect any future changes that might indicate re‑activation.