moonshot-poll[.]fun

This domain, moonshot-poll.fun, was registered on April 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The site presents a page titled “Vote to List — Powered by Moonshot,” which is a clear attempt to mimic the legitimate Moonshot brand. The content and visual cues are designed to lure users into believing the page is an official Moonshot service, satisfying the criteria for a brand‑impersonation campaign. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3, an address owned by Cloudflare, Inc. The hosting appears to be positioned in Canada, as indicated by the Cloudflare location data. DNS resolution is handled by the Cloudflare nameservers brett.ns.cloudflare.com and addilyn.ns.cloudflare.com. The site serves an HTTPS certificate issued by Let’s Encrypt, which is typical for short‑lived malicious infrastructure that relies on free, automated certificates. Threat intelligence sources flag the domain as high‑risk. Four independent blocklists have already listed moonshot-poll.fun, and the site has been blocked by multiple security filters. VirusTotal reports that three out of ninety‑five scanners have identified malicious behavior, while the Gridinsoft trust score is 0 out of 100, indicating a complete lack of confidence. An AlienVault OTX pulse references the domain in a single threat‑intel record, reinforcing its association with phishing activity. Defenders should prioritize immediate mitigation. Network perimeter controls ought to block both the domain name and its resolved IP address. Email gateways and web proxies must be updated to recognize the brand‑impersonation pattern used by this site. Continuous monitoring of newly registered domains that reference Moonshot or similar branding is recommended to detect future variants. Users should be educated to verify URLs and avoid entering credentials on pages that display unexpected brand prompts.