portal-moonshot[.]com

The domain www.portal-moonshot.com was registered on February 27, 2026 through Name.com, Inc. and is hosted on the Amazon Web Services network (AS16509). DNS resolution points to the IPv4 address 216.150.16.129, which belongs to the United States and is associated with Amazon.com, Inc. The domain is served by Vercel infrastructure, as indicated by the presence of Vercel‑managed nameservers ns1.vercel-dns.com and ns2.vercel-dns.com and the detection of Vercel technology in the HTTP response. TLS termination is provided by a Let’s Encrypt certificate (R13), and the server advertises HTTP Strict Transport Security. An HTTP request to the root path returns a 404 status code with the page title “404: NOT_FOUND”, indicating that no legitimate landing page is currently hosted.

Threat intelligence classifies the domain as a brand‑impersonation site targeting the Moonshot brand and associates it with a crypto‑scam campaign. VirusTotal analysis records detections from two of ninety‑three security vendors, and the domain is listed on the PhishDestroy blocklist, representing a single known blocklist entry. The current operational status is marked as offline, suggesting that the malicious content may have been removed or the site is no longer reachable. While the available evidence confirms the use of legitimate cloud services and a valid TLS certificate, the combination of brand impersonation, crypto‑scam labeling, and vendor detections indicates a heightened risk of abuse.

Defenders should continue to monitor the IP address 216.150.16.129 and the associated AS for any re‑activation of malicious services. The domain should be added to internal block lists for brand‑impersonation and crypto‑scam categories, and traffic to the host should be inspected for anomalous patterns. Further investigation is recommended to determine whether the site previously hosted phishing or credential‑harvesting pages, as the current 404 response does not reveal the original payload.