votes-moonshot[.]net

The domain votes-moonshot.net is currently flagged as a high‑risk brand‑impersonation site targeting the Moonshot brand. Analysis shows the site is active, returning HTTP 521, and its page title reads “Vote to List — Powered by Moonshot,” indicating deliberate use of the Moonshot name to mislead users. The domain was registered on 21 February 2026 through CNOBIN INFORMATION TECHNOLOGY LIMITED and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., located in the United States.

Infrastructure assessment reveals the domain is served behind Cloudflare’s network, employing Cloudflare Browser Insights and HTTP/3. The TLS certificate is issued by Google Trust Services under the WE1 profile, confirming a valid SSL chain. Nameservers stevie.ns.cloudflare.com and todd.ns.cloudflare.com are in use, consistent with the Cloudflare hosting. The site’s technology stack includes Tailwind CSS, suggesting a modern front‑end framework.

Threat intelligence shows the domain appears on four external blocklists and has been blocked by multiple security products, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal has logged two detections out of ninety‑five scanned engines, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification. The listed scam type is cryptocurrency, aligning with the “Vote to List” phrasing that may be used to lure victims into financial transactions.

Defenders should add votes-moonshot.net to domain deny lists and configure network filters to drop traffic to its IP range. Continuous monitoring of Cloudflare‑associated DNS changes is advised, as the infrastructure could be shifted to new endpoints without notice. Security teams should also update URL and content inspection rules to capture the specific page title and any references to Moonshot, and enforce user awareness training regarding unsolicited voting or listing requests that cite the Moonshot brand.