moonshot-rankings[.]com

Analysis of moonshot-rankings.com indicates a high-risk cryptocurrency scam impersonating the Moonshot brand. The domain, registered on March 11, 2026, through Hello Internet Corp, currently resolves to IP address 172.67.201.49, hosted on Cloudflare's infrastructure (AS13335). Infrastructure analysis reveals the use of Cloudflare nameservers (mallory.ns.cloudflare.com and trey.ns.cloudflare.com) and a Let's Encrypt SSL certificate (E7), which while common, does not mitigate the domain's malicious classification. The domain is flagged in 22 threat intelligence pulses on AlienVault OTX and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, confirming its active abuse status. The page title 'Index of /' suggests either a misconfigured or intentionally minimal landing page, though the exact content remains unanalyzed. The domain's HTTP 301 redirect status may indicate an attempt to obscure its final destination or evade detection. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. While only one of 94 security vendors on VirusTotal flags the domain, this does not diminish the weight of other indicators, including its presence on multiple blocklists and threat intelligence platforms. Defenders should treat this domain as an active threat targeting cryptocurrency users under the guise of Moonshot. Immediate blocking at the DNS or network level is recommended, along with monitoring for related infrastructure or domains registered through the same registrar. Given the domain's recent creation and consistent malicious indicators, it is likely part of a broader campaign, and further investigation into associated IPs or certificates may uncover additional threats.