app-moonshot[.]net

The domain app-moonshot.net was registered on April 18 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 104.21.7.166, which is hosted by Cloudflare, Inc. in Canada. The authoritative nameservers are amy.ns.cloudflare.com and pranab.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and proxy services. A TLS certificate issued by Let’s Encrypt (certificate identifier E8) is present, providing HTTPS encryption for the site. An HTTP request receives a 301 redirect response, suggesting that the domain forwards traffic to another location, though the final destination has not been captured. The domain appears on a single security blocklist and has been listed in an AlienVault OTX pulse, confirming that it has been observed by at least one external threat‑intelligence source. The site is classified as an impersonation campaign targeting the brand Moonshot. The only visible page title is “Index of /”, which is a generic directory listing and does not reveal any credential‑capture page or malicious payload. No detections were reported on VirusTotal (0/95 scans) and the domain is not currently flagged by additional scanning engines, leaving the exact content and payload unknown. The presence of the brand name in the domain and the impersonation label indicate a deliberate attempt to deceive users seeking legitimate Moonshot services. Defenders should add app-moonshot.net to URL filtering and sink‑hole rules to prevent end‑user access. Monitoring of the associated IP address 104.21.7.166 for any subsequent hosting changes is advised, as the Cloudflare front‑end can be repurposed for different malicious campaigns. Continuous observation of the domain’s DNS records and blocklist status is recommended, and any newly observed redirects or page content should be incorporated into incident response playbooks targeting brand‑impersonation threats.