moonshot-voting[.]app

Analysis of the domain moonshot-voting.app indicates a crypto scam impersonating the Moonshot brand. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain was flagged by 9 of 95 security vendors on VirusTotal, reflecting elevated risk prior to takedown. As of July 24, 2026, the domain is offline, returning an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare.' The site was blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL, and appears on four security blocklists. Gridinsoft assigned a trust score of 0/100.

Infrastructure analysis reveals the domain resolved to IP 104.21.71.116, hosted on Cloudflare’s network (AS13335) in the US. Nameservers dean.ns.cloudflare.com and priscilla.ns.cloudflare.com were used, and the SSL certificate was issued by Google Trust Services (WE1). AlienVault OTX recorded the domain in one threat intelligence pulse, confirming its inclusion in active threat tracking. While the domain is currently offline, its prior detection by multiple security vendors and blocklists suggests it was actively used for malicious purposes.

Defenders should treat any residual DNS or cached resolutions as high-risk and verify blocking mechanisms remain in place. The exact content or phishing kit used on the site is not yet analyzed, but the available indicators align with crypto-related fraud targeting Moonshot users. No further infrastructure or registration anomalies were identified beyond the provided data.