vote[.]moonshoots[.]xyz

The domain vote.moonshoots.xyz was registered on February 21, 2026 and is currently listed as offline. Infrastructure analysis shows it resolves to the IP address 172.67.138.154, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The presence of a Cloudflare front‑end suggests the operator is leveraging a content‑delivery network to obscure the true hosting environment, a pattern commonly observed in phishing infrastructure. The SSL certificate associated with the domain is identified as WE1, indicating that a publicly trusted certificate has been provisioned, which can increase user confidence and aid social engineering attempts.

Reputation signals are strongly negative. The domain is blocked by two dedicated anti‑phishing services, PhishDestroy and ScamSniffer, and appears on two external security blocklists. VirusTotal reports that six out of ninety‑three scanning engines have flagged the domain, reinforcing the suspicion of malicious activity. Additionally, Gridinsoft assigns a trust score of 0 out of 100, effectively marking the site as completely untrusted.

Despite the available signals, certain details remain unknown. No public page title, Safe Browsing status, or Open Threat Exchange (OTX) entries have been disclosed, and no specific phishing kit or targeted brand is identified in the current intelligence set. Consequently, analysts cannot confirm the exact content or the precise lure employed by the site, only that its operational profile aligns with generic phishing campaigns.

Defenders should treat vote.moonshoots.xyz as hostile. Recommended actions include adding the domain to corporate web filters, updating endpoint blocklists with the observed IP 172.67.138.154, and monitoring for any future resolution changes that might indicate a shift in hosting. Given the low trust score and multiple vendor detections, any email or web traffic referencing the domain should be blocked or quarantined pending further investigation.