xn--monshots-w6c[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting Moonshot, a recognized technology platform. The site presents itself as a legitimate Moonshot-affiliated portal under the guise of a 'Vote to List' campaign, a common tactic to harvest user credentials or disseminate malicious payloads. Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The infrastructure resolves to IP address 188.114.96.3, hosted on Cloudflare's network (AS13335), which is often exploited to obfuscate malicious activity behind content delivery networks. Technical indicators confirm the domain's malicious nature. VirusTotal reports 9 out of 95 security vendors flagging xn--monshots-w6c.com as malicious, with detection signatures pointing to phishing or brand impersonation. The domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (serial number E8), is consistent with short-lived certificates used in phishing campaigns. The page title, 'Vote to List — Powered by Moonshot,' directly impersonates Moonshot's branding, further corroborating the intent to deceive users. Infrastructure analysis reveals the domain is currently offline, though historical resolution to the US-based IP suggests prior active exploitation. Mitigation requires immediate action from network defenders and end-users. Organizations should block the domain at the DNS or proxy level, along with its resolving IP (188.114.96.3), to prevent access. Security teams are advised to monitor for connections to the IP or registrar-associated domains, as these may indicate compromised endpoints. End-users should be trained to recognize brand impersonation tactics, particularly those leveraging fake voting or survey pages. Given the domain's offline status, continuous monitoring for reactivation or related infrastructure is recommended, as threat actors often reuse registrant details or IP ranges for subsequent campaigns.