vote-moonwell[.]com

This domain, vote-moonwell.com, was registered on 10 April 2026 through Realtime Register B.V. and is presently active. The authoritative name servers are collins.ns.cloudflare.com and corey.ns.cloudflare.com, pointing the domain to the Cloudflare‑owned IP address 188.114.97.3 located in Canada. The site presents a generic “Just a moment…” page and returns HTTP 403, indicating that the content is being shielded behind a challenge or access control layer. The TLS certificate is issued by Let’s Encrypt (E8), confirming the use of a free, automated certificate rather than a brand‑specific one. Reputation signals are uniformly negative. Gridinsoft assigns a trust score of 0 out of 100, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have already listed the domain. VirusTotal analysis shows that 2 of 95 scanned security vendors flag the domain, and it appears on three additional security blocklists. The low vendor count may reflect limited exposure rather than benign intent, and the presence of a generic title and a 403 response prevents a full content analysis, leaving the exact phishing payload unknown. Defenders should treat vote-moonwell.com as a high‑risk indicator. Immediate actions include adding the domain and its resolving IP (188.114.97.3) to outbound deny lists, enforcing URL filtering for any traffic that matches the “Just a moment…” pattern, and monitoring DNS queries for the associated Cloudflare name servers. Continuous re‑evaluation is advised, as the low number of vendor flags could change if the site begins serving malicious payloads. Logging of TLS handshake details may also help correlate future attempts to the Let’s Encrypt/E8 certificate observed today.