moonshot-listing[.]trade

This domain, moonshot-listing.trade, is actively impersonating the Moonshot brand and has been flagged for high-risk phishing activity. Registered on November 11, 2025, through NiceNIC International Group Co., Limited, the domain remains operational as of July 12, 2026. Analysis indicates it resolves to the IP address 188.114.97.3 and is protected by Cloudflare infrastructure, utilizing HTTP/3 for communication. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to malicious sites. Threat intelligence sources confirm the domain’s association with malicious activity. AlienVault OTX lists it in 23 distinct threat intelligence pulses, while 13 out of 95 security vendors on VirusTotal have flagged it as malicious. The domain appears on three security blocklists and is actively blocked by multiple detection systems, including ScamSniffer, PhishDestroy, and BLP-Malware. The page title explicitly displays 'Moonshot,' aligning with the reported brand impersonation. Despite these indicators, the exact content and functionality of the site remain unanalyzed, leaving the precise phishing mechanism unclear. Defenders should treat this domain as a confirmed threat. The combination of brand impersonation, Cloudflare hosting, and active blocking by security tools suggests a deliberate attempt to deceive users. Network-level blocking of 188.114.97.3 and the domain itself is recommended, along with monitoring for related subdomains or IP associations. Given the domain’s registration age and continued activity, it is likely part of an ongoing campaign rather than a short-lived operation. Further investigation into the hosting provider and certificate transparency logs may reveal additional infrastructure linked to this threat.