# votes-moonwell.finance — SUSPICIOUS

> Investigate the phishing risk of votes-moonwell.finance. Learn about its IP, blocklist status, and current threat level to stay protected.

## Summary
PhishDestroy identifies votes-moonwell.finance as an active phishing domain posing a medium-level risk. The site is associated with generic phishing tactics, potentially aimed at deceiving users into revealing sensitive information by mimicking legitimate financial or voting platforms.

The domain resolves to the IP address 188.114.97.3 and has been detected on two separate security blocklists, indicating prior suspicious activity or malicious intent. This infrastructure detail supports the classification of the domain as a threat and suggests ongoing attempts to exploit users through this IP.

Currently, votes-moonwell.finance remains active and continues to be monitored by security researchers. Users are advised to avoid interacting with this domain and to employ updated threat detection tools. Organizations should block this domain at network perimeters and educate users about the risks associated with suspicious financial voting sites.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Page title: Un instant…

## Domain Intelligence
- Registered: 2026-03-04 17:07:02
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 188.114.97.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["adam.ns.cloudflare.com", "danica.ns.cloudflare.com"]
- SSL Issuer: Let's Encrypt / E7

## Detection Status
- VirusTotal: 4 vendors flagged
  Vendors: ["Fortinet", "Gridinsoft", "Seclookup", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://i.ibb.co/nq0sChSv/acf252514958.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/votes-moonwell.finance
- Wayback Machine: https://web.archive.org/web/https://votes-moonwell.finance
- PhishDestroy: https://phishdestroy.io/domain/votes-moonwell.finance/
- LLM endpoint: https://phishdestroy.io/domain/votes-moonwell.finance/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/votes-moonwell.finance/
Last updated: 2026-03-19