moonvotein[.]fun

Analysis of moonvotein.fun, created on February 27 2026 and currently taken offline, shows a clear pattern of brand impersonation targeting Moonshot. The domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution uses Cloudflare’s authoritative nameservers arnold.ns.cloudflare.com and ligia.ns.cloudflare.com, indicating the site leveraged Cloudflare’s infrastructure for hosting and potential traffic masking. No TLS certificate was observed for the domain, meaning HTTPS connections are not supported and any traffic would be transmitted over HTTP, reducing transport‑level security.

The page title returned by the server, "Vote to List — Powered by Moonshot," directly references the Moonshot brand, confirming the impersonation intent. Registration was performed through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with short‑lived malicious domains. VirusTotal scans flagged the domain in six of ninety‑three security vendors, demonstrating modest but notable detection across independent scanners. Additionally, moonvotein.fun appears on four external blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—providing corroborating evidence that security‑focused services have catalogued the domain as malicious.

Defenders should treat the domain as hostile infrastructure despite its offline status, as the underlying hosting assets remain under Cloudflare control and could be re‑activated. Network‑level controls ought to block traffic to the IP 188.114.97.3 and to the domain name itself. Email gateways and web filters should incorporate the known blocklist entries and the brand‑impersonation tag to prevent user exposure. Because no SSL certificate is present, any future activation would likely rely on HTTP, simplifying detection through protocol inspection. Continuous monitoring of the registrar PDR Ltd.