moonshot-gem[.]money

This domain, moonshot-gem.money, is actively flagged as a high-risk crypto scam impersonating the Moonshot brand, as indicated by its page title and confirmed threat intelligence. Infrastructure analysis reveals the domain is hosted behind Cloudflare (AS13335), resolving to IP 172.67.159.208 in the United States, with nameservers finley.ns.cloudflare.com and gigi.ns.cloudflare.com. The site employs Cloudflare technologies, including HTTP/3, and presents a 301 HTTP redirect, suggesting it may funnel traffic to another malicious endpoint. The SSL certificate is issued by Google Trust Services (WE1), a common but not inherently suspicious provider. The domain appears in 23 threat intelligence pulses, including blocklists such as PhishDestroy and ScamSniffer, and is flagged by 14 of 95 security vendors in aggregated scans. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. While the exact content of the site remains unanalyzed, the available evidence—including the scam type designation as a crypto scam and the explicit impersonation of Moonshot—aligns with known patterns of fraudulent investment or token-related schemes. Defenders should treat this domain as confirmed malicious and prioritize blocking it at the DNS, IP, and certificate levels. The use of Cloudflare infrastructure may complicate takedown efforts, but monitoring for associated IPs, nameservers, or SSL certificates can help identify related threats. Given its active status and high-risk classification, immediate action is recommended to mitigate potential financial or credential theft targeting Moonshot users.