top-moonshot[.]fun

Analysis of top-moonshot.fun shows a high‑risk brand‑impersonation campaign targeting the Moonshot brand. The domain was registered on March 06, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and uses Cloudflare’s DNS service (roxy.ns.cloudflare.com, george.ns.cloudflare.com). It resolves to IP 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. in the United States. The site presents a TLS certificate from Let’s Encrypt (E7) and enforces HSTS, with HTTP/3 support, but returns HTTP 403 for the current request. The page title is "Just a moment..." and the scam type is identified as a crypto scam that impersonates Moonshot. The domain is listed on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal records indicate that one of ninety‑four security vendors flagged the domain, while Gridinsoft assigns a trust score of 0 / 100. Defenders should treat the domain as malicious, block network traffic to 188.114.97.3, add the domain to URL filtering policies, and monitor for any related indicators such as the Cloudflare nameservers or the Let’s Encrypt certificate fingerprint. Continued observation is advised to capture any changes in the HTTP response or additional vendor detections.