moonshot-votes[.]pages[.]dev

Analysis conducted on July 24, 2026 identifies moonshot-votes.pages.dev as an offline infrastructure used for a brand-impersonation crypto scam targeting the Moonshot brand. The domain was registered through Cloudflare, Inc. on February 27, 2026 and resolves to the Cloudflare edge address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The site presented the page title “Vote to List — Powered by Moonshot,” indicating a direct reference to the Moonshot brand. An SSL certificate issued by Let’s Encrypt (E7) was observed, and the connection employed HSTS, HTTP/3, and Unpkg assets, all typical of Cloudflare‑hosted pages.

The domain’s trust score from Gridinsoft is 0/100, reflecting a high likelihood of malicious intent. VirusTotal scans recorded three positive detections out of ninety‑three vendors, and the domain appears on one external blocklist. HTTP requests return a 403 status code, and the site has been taken offline, with PhishDestroy confirming the takedown. Nameservers listed include adi.ns.cloudflare.com, ernest.ns.cloudflare.com, karl.ns.cloudflare.com, and ursula.ns.cloudflare.com.

While the exact phishing page content has not been captured, the combination of brand‑specific page title, low trust score, vendor detections, and blocklist inclusion supports the classification as a crypto‑related brand‑impersonation campaign. Defenders should continue to block the domain at network perimeters, add the IP address 188.114.96.3 to threat‑intel feeds, and monitor for newly registered subdomains under the same Cloudflare nameserver pattern that reference Moonshot. Ongoing surveillance of Cloudflare‑registered domains created after February 2026 may reveal additional infrastructure linked to this campaign.