moonxshot-vote[.]com

The domain moonxshot-vote.com was registered on March 04, 2026 and is presently taken offline. It lacks an SSL certificate, indicating that any traffic to the site would be unencrypted. The authoritative nameservers are a.dnspod.com, b.dnspod.com, and c.dnspod.com, consistent with the use of DNSPod’s hosted service. DNS resolution points to IP address 178.212.12.231, which belongs to AS62082 Hostland LTD and is geolocated in the Russian Federation.

Registration was performed through Hello Internet Corp, a registrar that frequently appears in threat actor infrastructure. The site’s HTML title reads “MOON – Vote to list on Moonshot,” directly referencing the legitimate Moonshot brand and confirming a brand‑impersonation intent. VirusTotal records show that two of ninety‑five security vendors flagged the domain, providing modest independent detection. Four security blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—have already listed the domain, reinforcing its malicious classification.

Although the page content beyond the title has not been publicly disclosed, the combination of brand‑specific wording, lack of TLS, and rapid blocklist inclusion suggests a targeted impersonation campaign aimed at deceiving Moonshot users. Defenders should ensure that outbound filtering solutions block connections to 178.212.12.231 and add moonxshot‑vote.com to internal deny lists. Continuous monitoring of DNS changes for this domain is advised, as the threat actor may reactivate the site using the same infrastructure. Organizations referencing Moonshot should alert users to the existence of this impersonation attempt and advise verification of URLs before interacting with any Moonshot‑related services.