xn--monshot-d5b[.]com

Analysis of xn--monshot-d5b.com indicates a high‑risk brand‑impersonation campaign targeting the Moonshot brand. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to 172.67.186.21, an address owned by Cloudflare (AS13335) located in the United States. The site presented a TLS certificate issued by Let’s Encrypt (E7) and used Cloudflare’s DNS service, with authoritative nameservers dean.ns.cloudflare.com and priscilla.ns.cloudflare.com. HTTP requests return a 403 status code, and the page title observed during the brief scan was “Vote to List — Powered by Moonshot,” consistent with a Wallet Connect abuse kit that leverages Moonshot’s brand to lure victims.

Threat intelligence sources corroborate the malicious intent. The domain appears in one AlienVault OTX pulse and is listed on four independent security blocklists. VirusTotal scans show 12 of 93 antivirus engines flag the domain as malicious, and it is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. The combination of brand impersonation, the Wallet Connect abuse kit, and the presence on multiple blocklists confirms the classification as a brand‑impersonation scam.

Uncertainty remains regarding the current content because the domain was taken offline before a full content capture could be performed; the observed page title is the only visible artifact. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the IP address 172.67.186.21 to threat‑intel feeds. Organizations that integrate Moonshot services or use Wallet Connect should educate users to verify legitimate URLs and consider employing real‑time URL reputation services that include the listed blocklists. Ongoing observation of Cloudflare‑hosted domains for similar patterns is recommended.