poll-moonshot[.]xyz

Analysis of the domain poll-moonshot.xyz indicates confirmed malicious activity targeting users of the Moonshot brand, classified as a crypto scam. The domain was registered on December 23, 2025, through NameSilo, LLC, a registrar frequently associated with phishing infrastructure. Infrastructure analysis reveals the domain resolves to the IP address 64.187.97.204, hosted on AS400343 (NAMESILO, L.L.C.) in Canada. The nameservers ns1.hostsilo.com and ns2.hostsilo.com further link the domain to a known hosting pattern used in prior phishing campaigns. At the time of assessment, the domain was offline, returning an HTTP status consistent with a disabled or suspended site.

The page title 'Index of /' suggests either a misconfigured server or an attempt to conceal malicious content from casual inspection. No SSL certificate was present, increasing the likelihood of interception or tampering during data transmission. Detection metrics from security vendors indicate elevated risk: eight of ninety-three engines on VirusTotal flagged the domain as malicious. Additionally, the domain appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer, both of which specialize in cryptocurrency-related fraud detection.

The Gridinsoft trust score of 0/100 reinforces the domain's classification as high-risk. While the exact content of the site remains unanalyzed due to its offline status, the combination of brand impersonation, crypto scam classification, and detection by specialized security tools confirms its malicious intent. Defenders are advised to block the domain at the DNS level, monitor for re-registration or IP reuse, and alert users to the risk of Moonshot-themed crypto scams. Further investigation into associated infrastructure, such as the hosting provider and nameservers, may uncover additional related threats.