quest-moonshot[.]com

Analysis shows that quest-moonshot.com is an active domain employed for brand impersonation of Moonshot. The domain resolves to the IP address 188.114.97.3, which is owned by Cloudflare, Inc. and is geolocated to Canada. It is served over HTTPS using a Let’s Encrypt certificate (issuer identifier YE2) and is hosted on Cloudflare’s infrastructure, as indicated by the authoritative nameservers and the Cloudflare‑provided HTTP 403 response. The page title returned by the server is "Just a moment...", suggesting a Cloudflare challenge page rather than a visible phishing landing page. Registration was performed through OwnRegistrar, Inc. The domain has been flagged by three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports three of ninety‑one security vendors flagging the domain, confirming a non‑trivial detection rate. The threat is classified as brand impersonation, targeting the Moonshot brand. While the exact malicious payload or credential‑stealing mechanism has not been observed, the convergence of Cloudflare hosting, a blocked status, and multiple vendor detections indicate a high‑risk profile. Defenders should block network resolution to 188.114.97.3 for this hostname, add quest-moonshot.com to URL filtering rules, and monitor for any related traffic to Cloudflare edge nodes. Continuous re‑evaluation is advised as additional telemetry becomes available.