vote-moonshot[.]top

The domain vote-moonshot.top was registered on May 19, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It is configured to use the Cloudflare name servers grant.ns.cloudflare.com and suzanne.ns.cloudflare.com and resolves to the Cloudflare‑owned address 172.67.151.253, which is geolocated to California, United States. The site presents a single HTTP response with the title "404 Not Found" and serves over HTTPS with a Let’s Encrypt certificate (issuer E8). Technical fingerprints reveal the presence of HSTS, Cloudflare Browser Insights, the Cloudflare reverse‑proxy service, and HTTP/3 support.

The domain is classified as a brand‑impersonation campaign targeting the Moonshot brand, and it has been listed on three security blocklists. It is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that three of ninety‑one scanning engines flagged the domain as malicious, confirming the presence of suspicious activity. The domain’s current operational status is offline, indicating that the malicious site has been taken down or is no longer serving content.

While the available data confirms the hosting infrastructure, registration details, and initial detection, the exact content of the phishing page, credential‑stealing mechanisms, and any associated command‑and‑control infrastructure remain unknown due to the 404 response and offline status. Defenders should continue to monitor the associated IP address and Cloudflare name servers for any re‑use, enforce blocking of vote-moonshot.top across web filters, and update threat‑intel feeds to reflect the brand‑impersonation indicator. Additional scrutiny of traffic to the underlying IP and correlation with other Moonshot‑related phishing attempts may help uncover any lingering infrastructure or future campaigns.