xn--mooshots-sqb[.]net

Analysis of xn--mooshots-sqb.net, observed on July 24, 2026, identifies a brand‑impersonation campaign targeting the cryptocurrency brand celer. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare, resolving to IP address 172.67.215.8, which is assigned to AS13335 Cloudflare, Inc. in the United States. No SSL certificate is present, indicating an unencrypted HTTP service. The public page title returned by the server is "Vote to List — Powered by Moonshot," a string that does not reference the underlying brand and suggests a possible content‑spoofing tactic.

VirusTotal reports seven detections out of ninety‑five scanning engines, confirming that multiple security products flag the domain as malicious. The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, and receives a Gridinsoft trust score of 0 out of 100, reinforcing its classification as a high‑confidence threat. Nameserver configuration lists dean.ns.cloudflare.com and priscilla.ns.cloudflare.com, consistent with the Cloudflare front‑end.

Current online status is offline, but historical evidence shows the infrastructure was active before takedown. Defenders should continue to block the IP 172.67.215.8 and the associated domain across perimeter and endpoint filters, monitor for any re‑registration attempts, and incorporate the domain’s identifiers into threat‑intelligence feeds. Given the low trust score and multiple vendor detections, it is advisable to treat any future occurrences of this indicator as malicious and to educate users about unsolicited messages that reference celer or cryptographic voting mechanisms.