vote-mnshts[.]fun

The domain vote-mnshts.fun was registered on February 26, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently taken offline. DNS resolution points to 188.114.97.3, an IP address owned by Cloudflare (AS13335) located in the United States. The domain is hosted on Cloudflare’s network and does not present an SSL/TLS certificate, indicating that any HTTP service would be delivered without encryption. The page title retrieved from the site, "Vote to List — Powered by Moonshot," together with the explicit label "Impersonates: Moonshot" and the scam type "Brand Impersonation," demonstrates a clear attempt to mimic the Moonshot brand.

The site has been flagged by four security blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—and appears on four additional public blocklists, confirming that multiple threat‑intelligence providers consider it malicious. VirusTotal analysis shows that five of ninety‑three scanners flagged the domain, reinforcing the suspicion of malicious activity. Known indicators include the use of Cloudflare’s public nameservers cass.ns.cloudflare.com and troy.ns.cloudflare.com, which are common for fast‑flux or anonymized hosting.

While the offline status prevents direct verification of the site’s content, the convergence of brand‑impersonation cues, blocklist listings, and partial VirusTotal detections provides sufficient evidence for a high confidence rating of elevated risk. Defenders should continue to block vote-mnshts.fun at perimeter controls, update URL filtering rules, and monitor for any future re‑hosting of the domain on alternate IPs. Further investigation should focus on any residual DNS records that may point to backup infrastructure, and analysts should watch for similar domain patterns that combine the target brand name with random characters, as this tactic is likely to be reused in future campaigns.