moonshot[.]vote-portals[.]com

The domain moonshot.vote-portals.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335). DNS resolution points to IP 188.114.97.3, which is located in the United States and belongs to Cloudflare’s network. The site presented a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1) and returned an HTTP 403 status code, indicating that access to the underlying content was denied at the time of observation. The page title returned by the server is “Suspected phishing site | Cloudflare,” confirming that the domain has been flagged by Cloudflare’s protective services.

Reputation data shows a Gridinsoft trust score of 0 / 100 and the domain appears on two security blocklists, specifically PhishDestroy and ScamSniffer. VirusTotal analysis recorded 12 detections out of 91 scanners, reinforcing the malicious classification. The listed technology stack is limited to Cloudflare, and the nameservers are dean.ns.cloudflare.com and priscilla.ns.cloudflare.com. The campaign is identified as a brand‑impersonation effort targeting the Moonshot brand and is categorized as a crypto‑scam, although the exact payload or lure has not been captured.

Current status is offline, and no further content is accessible for deeper behavioural analysis. Defenders should continue to block the resolved IP address and associated hostnames, enforce DNS‑level filtering for the domain and its sub‑domains, and monitor for any re‑registration attempts or similar domains using the same registrar or Cloudflare name servers. Additional telemetry from endpoint detection platforms should be correlated with the 12 VirusTotal detections to identify potential infection vectors. Continuous watch‑list updates are recommended, given the active blocklist presence and the recent creation date of the domain.