moonshot-ratings[.]net

Analysis of moonshot-ratings.net shows that the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited. DNS resolution points to 172.67.165.39, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The authoritative nameservers are dean.ns.cloudflare.com and priscilla.ns.cloudflare.com, confirming that the infrastructure is hosted behind Cloudflare's edge network. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 signature, indicating proper TLS termination on the Cloudflare front end. Public scanning on VirusTotal recorded detections by 14 of 93 security vendors, reflecting a moderate level of malicious classification.

The domain is listed on two external blocklists and has been actively blocked by the PhishDestroy and ScamSniffer filtering services. An AlienVault OTX pulse references the domain in a single threat‑intel report, further corroborating its association with malicious activity. HTTP probing returned a 403 status code and the page title reports “522: Connection timed out”, suggesting that the underlying web service is presently unavailable. The current status is marked as taken offline, which aligns with the observed connection timeout.

The threat profile is identified as a crypto‑related scam that impersonates the brand Moonshot, indicating that any lure is likely to target users interested in cryptocurrency investments or transactions under the Moonshot name. Defenders should continue to deny any network traffic to 172.67.165.39, enforce blocklist entries for moonshot-ratings.net, and monitor for new domains that resolve to the same Cloudflare IP range and use similar naming patterns. Because the SSL certificate is legitimate, reliance on certificate trust alone is insufficient; threat intelligence feeds and domain reputation services remain essential for early detection.