vote-moonshot[.]money

This domain, vote-moonshot.money, is flagged as a high‑risk brand‑impersonation site targeting the cryptocurrency brand Moonshot. The publicly visible page title is “Moonshot”, matching the declared brand target and confirming the intent to mislead users seeking legitimate Moonshot services. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc. The authoritative nameservers are logan.ns.cloudflare.com and nia.ns.cloudflare.com, both associated with the Cloudflare DNS service. The site presents an SSL certificate issued by Google Trust Services under the WE1 identifier, indicating a valid TLS chain but offering no guarantee of legitimacy. An HTTP 301 redirect is observed, and the server advertises support for HTTP/3, consistent with Cloudflare’s edge platform. Reputation data indicates the domain is currently listed on two public blocklists and has been blocked by the PhishDestroy and ScamSniffer detection engines. VirusTotal reports five out of ninety‑five security vendors flagging the domain as malicious, and the Gridinsoft trust score is recorded as 0 out of 100, reinforcing the high‑risk assessment. The combination of brand impersonation, a cryptocurrency scam classification, and active status suggests ongoing malicious activity. Defenders should continue to block vote-moonshot.money at network perimeter and endpoint layers, enforce URL filtering, and monitor outbound connections to the associated IP address. Since the domain is hosted on a shared Cloudflare infrastructure, additional heuristics such as sudden appearance of new subdomains or anomalous traffic patterns should be correlated with threat intelligence feeds. Ongoing observation of the domain’s DNS records and certificate transparency logs is advised to detect any future changes that could affect mitigation strategies.