Analysis indicates that the domain voteonmoonshot.live was registered on July 30, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain is delegated to Cloudflare name servers miguel.ns.cloudflare.com and tegan.ns.cloudflare.com and resolves to the IP address 188.114.96.3, a host that currently appears in the Cloudflare network. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that it is being used for malicious purposes.
VirusTotal has processed the domain with 91 scanning engines; none have raised a detection at the time of analysis, but the absence of a flag does not constitute evidence of benign intent. No public page title, SSL certificate details, or HTTP response data are available, and the domain does not yet appear in Google Safe Browsing or AlienVault OTX feeds. The limited observable indicators suggest a newly created, active phishing infrastructure that leverages Cloudflare's DNS and edge services to hide the true hosting location.
Defenders should add voteonmoonshot.live to deny‑list rules at perimeter and email gateways, monitor DNS queries for the domain, and consider blocking outbound connections to the resolved IP 188.114.96.3. Continuous re‑assessment is recommended, as the lack of current detections may change rapidly and additional indicators could surface.