ms-vote[.]fun

The domain ms-vote.fun was registered on February 28 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the Cloudflare address 172.67.169.138, which is announced by ASN 13335 and geo‑located in the United States. The authoritative nameservers are dora.ns.cloudflare.com and roan.ns.cloudflare.com, indicating that the site is hosted behind Cloudflare’s reverse‑proxy network. No SSL certificate is presented, so the site does not provide HTTPS encryption.

The page title observed during the brief crawl was “Vote to List — Powered by Moonshot”, and the domain is explicitly classified as a brand‑impersonation campaign targeting the Moonshot brand. Four security blocklists have listed the domain, and it is currently blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal reports that four of ninety‑three scanned security vendors flagged the domain as malicious, confirming a low‑to‑moderate detection rate across vendors. The site’s status is reported as taken offline at the time of analysis, which limits immediate exposure but does not remove the underlying infrastructure.

Evidence indicates that the malicious actor leveraged a legitimate‑looking voting theme to lure victims into interacting with a Moonshot‑related interface, although the exact payload or credential‑harvesting mechanism has not been publicly disclosed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection of the domain or related Cloudflare IPs, and add the observed indicators—IP 172.67.169.138, the two Cloudflare nameservers, and the page title string—to threat‑intel feeds. Because the domain lacks TLS, any future re‑hosting would be trivially detectable by the absence of a certificate. Analysts should also watch for new registrations that reuse the “ms‑vote” pattern or reference Moonshot in the title, as the campaign may be replicated with slight variations.