xn--monshots-z80d[.]net

This domain, xn--monshots-z80d.net, is identified as a brand impersonation phishing site targeting Moonshot. Analysis indicates the infrastructure was designed to mimic legitimate Moonshot services, specifically presenting a page titled 'Vote to List — Powered by Moonshot.' The domain is currently offline, but prior activity suggests it was actively used for deceptive purposes. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 104.21.33.169 and employs Cloudflare with HTTP/3 support. The SSL certificate is issued by Let's Encrypt. Despite its deceptive nature, the domain has not been flagged by any of the 95 vendors on VirusTotal, though it appears on three security blocklists: ScamSniffer, PhishDestroy, and OISD. The use of Cloudflare and a valid SSL certificate may have contributed to its initial evasion of detection. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the infrastructure remains a potential threat if reactivated. Organizations and individuals are advised to monitor for re-emergence of this domain or similar impersonation attempts. Network-level blocking of the IP address 104.21.33.169 and implementation of domain-based filtering for xn--monshots-z80d.net is recommended. Users should verify the authenticity of any Moonshot-related communications or pages, particularly those soliciting votes or personal information, by cross-referencing with official Moonshot channels.