vote-moonshots[.]xyz

This domain, vote-moonshots.xyz, was registered on 21 February 2026 and is currently taken offline. DNS resolution points to the IP address 172.67.197.42, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site employed an SSL certificate identified as WE1, indicating that HTTPS was available at the time of observation. VirusTotal analysis recorded six positive detections out of ninety‑three submitted scanners, confirming that multiple security engines flagged the domain as malicious.

The domain is listed on three external blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating that reputable threat‑intel feeds have already added it to their deny lists. The campaign is classified as a brand‑impersonation operation targeting the Moonshot brand and is described as a crypto‑scam. No additional artefacts such as a page title, Safe Browsing verdict, or Open Threat Exchange (OTX) identifiers were supplied, so the exact content and lure mechanisms remain unverified. Likewise, registrar details and any associated trust‑score metrics have not been disclosed, limiting the ability to assess registration‑abuse patterns.

Defenders should update their network controls to block DNS resolution to 172.67.197.42 and add vote-moonshots.xyz to local deny lists. Because the domain appears on multiple community blocklists, ingesting those feeds into firewalls, proxy filters, and endpoint protection suites will provide layered protection. Continuous monitoring of Cloudflare‑originated IP ranges for new domains that resolve to the same address is recommended, as threat actors often reuse the same hosting infrastructure for subsequent campaigns. Finally, security teams should retain the VirusTotal detection count and the six vendor flags as evidence for incident response documentation and consider sharing the indicator of compromise with industry‑wide sharing platforms to improve collective awareness.