moonshot-trade[.]top

This domain, moonshot-trade.top, is actively impersonating the Moonshot brand as part of a high-risk phishing operation. Registered on May 27, 2026, through 耐思尼克国际集团有限公司, the domain resolves to IP address 64.29.17.1, hosted by Vercel, Inc in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (bart.ns.cloudflare.com and lady.ns.cloudflare.com) and a Let's Encrypt SSL certificate (YR1). The site returns an HTTP 200 status and presents a page titled 'Vote to List — Powered by Moonshot,' explicitly referencing the targeted brand. Technical indicators include the use of Node.js, React, Vercel, Next.js, HSTS, and Webpack, suggesting a modern web application framework. The domain appears on one security blocklist and is flagged in four AlienVault OTX threat intelligence pulses. VirusTotal reports three detections from security vendors, though the specific nature of these detections remains unconfirmed. No additional scam classification beyond brand impersonation is provided in available intelligence. Defenders should prioritize blocking this domain at the DNS and network levels, revoking associated SSL certificates, and monitoring for related infrastructure. The domain remains active as of July 12, 2026, and further analysis of its content or payload is recommended to determine the exact phishing mechanism employed. Given the explicit brand reference in the page title and the use of Cloudflare and Vercel infrastructure, this site likely aims to deceive users into engaging with fraudulent content under the guise of a legitimate Moonshot service.