psyopvote[.]com

Analysis of psyopvote.com, created on 21 February 2026 and currently taken offline, reveals a classic brand‑impersonation infrastructure targeting the Moonshot brand. The site employed Cloudflare’s edge network (AS13335, United States) with HSTS and HTTP/3 enabled, and was served over TLS using a Google Trust Services / WE1 certificate. DNS resolution pointed to 172.67.161.233 and the authoritative nameservers were grace.ns.cloudflare.com and jose.ns.cloudflare.com, indicating a standard Cloudflare hosting setup. Registration was performed through Web Commerce Communications Limited, a registrar commonly used by malicious operators.

The page title observed, “Vote to List — Powered by Moonshot,” directly references Moonshot, confirming the impersonation intent. VirusTotal scans recorded eight detections out of ninety‑three security vendors, and the domain appears on two external blocklists, specifically PhishDestroy and ScamSniffer, reinforcing its malicious classification. While the site is presently offline, its recent creation date and rapid deployment of reputable hosting services suggest a short‑lived phishing campaign designed to harvest credentials or influence user actions under the guise of a legitimate Moonshot service.

Uncertainty remains regarding the exact payload delivered, the presence of any credential‑capture forms, or the distribution vector used to lure victims. Defenders should proactively block the domain at DNS and web‑filter layers, monitor for any new sub‑domains or look‑alike registrations that resolve to the same Cloudflare IP range, and enforce strict URL filtering for any references to Moonshot‑related voting or listing pages. Continuous threat‑intel feeds should be consulted for re‑appearance of the domain or related indicators, and incident response teams should be prepared to investigate any user reports that reference the observed page title or similar brand‑impersonation tactics.