votingmoonshot[.]fun

Analysis of votingmoonshot.fun shows a newly registered domain created on 28 February 2026 and hosted behind Cloudflare’s network (AS13335, IP 188.114.97.3, United States). The domain is delegated to the Cloudflare authoritative nameservers chance.ns.cloudflare.com and jade.ns.cloudflare.com and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com. No TLS certificate is presented; HTTP requests return the generic Cloudflare block page titled “Suspected phishing site | Cloudflare”, indicating that the site has been taken offline or intercepted by Cloudflare’s protective services. The infrastructure has been classified as a crypto‑related brand impersonation campaign targeting the Moonshot brand, as reflected in the supplied “Scam type: Crypto Scam” and “Brand target: Moonshot”.

VirusTotal reports that two of ninety‑three security vendors flagged the domain, and the Gridinsoft trust score is 0 / 100, suggesting a high likelihood of malicious intent. The domain appears on four independent blocklists – PhishDestroy, MetaMask, ScamSniffer and SEAL – confirming that multiple security vendors have already taken defensive action. Current status is offline, but the registration and hosting details remain active, allowing the operator to revive the site or repurpose the domain.

Defenders should immediately add votingmoonshot.fun to network‑level deny lists, enforce DNS sinkholing where possible, and monitor for any resurrection of the site or reuse of the underlying Cloudflare IP address. Continuous observation of new domains registered by the same registrar or using the same nameservers is advisable, as the threat actor may employ a fast‑flux style registration pattern. Because no TLS certificate is present and the page serves only a Cloudflare warning, there is no evidence of payload delivery, but the combination of brand impersonation, crypto‑scam labeling, low trust score, and blocklist presence warrants elevated vigilance.