listings-moonshot[.]net

The domain listings-moonshot.net was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to 188.114.97.3, an address owned by Cloudflare (AS13335) located in the United States. Infrastructure analysis shows the site is served behind Cloudflare’s network, uses HTTP/3, and presents a TLS certificate issued by Google Trust Services under the WE1 certificate authority. An HTTP 521 response indicates the origin server is unavailable, a pattern often observed in fraudulent sites that rely on Cloudflare’s error handling to hide backend content. The only visible page title is “Index of /”, providing no legitimate branding or functional context.

The domain is classified as a crypto‑related scam that impersonates the brand Moonshot, consistent with the reported brand‑impersonation threat type. Detection evidence includes placement on four security blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—and a VirusTotal scan where four of ninety‑three security vendors flagged the domain. Nameservers achiel.ns.cloudflare.com and aida.ns.cloudflare.com further confirm Cloudflare hosting.

While the exact content served at the origin is not disclosed, the combination of brand impersonation, crypto‑scam labeling, blocklist presence, and flagged VirusTotal results indicates a high‑risk profile. Defenders should immediately block listings-moonshot.net at network perimeters and DNS filters, add the associated IP 188.114.97.3 to reputation‑based deny lists, and monitor for any traffic that attempts to contact the domain or its Cloudflare edge nodes. Continuous re‑scanning with multi‑vendor services is advised to capture any changes in payload or hosting, and security teams should alert users of the Moonshot brand about this impersonation attempt to reduce exposure to credential harvesting or cryptocurrency theft.