moonshot-gems[.]money

Analysis of moonshot-gems.money indicates active brand impersonation targeting Moonshot, a known token project. The domain was registered through Web Commerce Communications Limited and currently resolves to IP 172.67.128.81, which is fronted by Cloudflare with HTTP/3 support. The SSL certificate is issued by Google Trust Services, a common configuration that does not mitigate the threat. The page title explicitly displays 'Moonshot,' reinforcing the impersonation intent. Security vendors have flagged the domain on three blocklists, and it appears in 23 threat intelligence pulses on AlienVault OTX. Seven of 95 security vendors on VirusTotal detect the domain as malicious. The domain remains active as of July 12, 2026, and is blocked by multiple security tools, including transaction monitoring systems. Defenders should treat this domain as high-risk infrastructure and prioritize blocking or monitoring its resolution. The exact content of the site has not been analyzed, but the combination of brand impersonation, Cloudflare proxying, and detection by security vendors confirms its use in malicious campaigns. No legitimate association with the Moonshot project is known.