moon-shot[.]icu

Analysis of the domain moon-shot.icu, first observed on March 4 2026, indicates a high‑risk brand‑impersonation campaign targeting the Moonshot brand. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 104.21.87.32, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is present, meaning the site is served over plain HTTP. The page title returned from the resolved host is “Vote to Earn SOL | Moonshot,” suggesting a lure that references the legitimate Moonshot brand.

The domain is listed on three security blocklists and has been flagged by ten of ninety‑four VirusTotal scanners, confirming that multiple independent engines consider it malicious. Additional telemetry shows the domain is blocked by PhishDestroy, MetaMask, and SEAL, and it received a Gridinsoft trust score of zero out of one hundred, reinforcing its classification as dangerous. Nameserver records point to aida.ns.cloudflare.com and burt.ns.cloudflare.com, both Cloudflare‑managed authoritative servers. At the time of reporting the domain is offline, which may indicate a temporary takedown or a shift to a new command‑and‑control location.

Because the underlying infrastructure (Cloudflare CDN, public registrar) is commonly abused, further malicious domains may be spun up using similar registration patterns. Defenders should ensure that outbound connections to 104.21.87.32 are denied or monitored, add moon-shot.icu to internal block lists, and extend filtering rules to include newly created domains registered through PublicDomainRegistry.com that reference “Moonshot” in their title or content. Continuous monitoring of Cloudflare‑hosted IP ranges for sudden spikes in traffic to newly registered .icu domains is recommended. Organizations should also educate users about unsolicited offers to “Vote to Earn SOL” and instruct them to verify URLs against official Moonshot communications before interacting.