moonshotlistingreward[.]pages[.]dev

PhishDestroy identifies moonshotlistingreward.pages.dev as a fraudulent domain actively impersonating the Moonshot brand. The site leverages a deceptive subdomain (listingreward) and Cloudflare’s infrastructure to host a Moonshot-themed reward listing scam. This operation targets users seeking legitimate Moonshot opportunities, redirecting them to a fraudulent interface designed to harvest credentials or cryptocurrency. While no drainer kit or advanced obfuscation has been observed, the domain’s branding and functional mimicry pose a credible deception threat to unsuspecting visitors.

Technical analysis reveals this domain was registered via Cloudflare, Inc., resolving to IP 188.114.96.3 with a valid Let’s Encrypt SSL certificate. VirusTotal currently scores it 2/95 detections, indicating it has not yet been widely flagged by antivirus engines. The domain remains unlisted in Google Safe Browsing (GSB) and has zero entries in public blocklists, suggesting low prior exposure. Creation date is not specified in available data, but the domain is currently active and operational under Cloudflare’s proxy network.

This brand impersonation threat is categorized as 'under_investigation' with an active status. PhishDestroy recommends immediate blocking of the domain and IP at network and endpoint levels. Users should avoid engagement and report any observed activity to Moonshot’s official security channels. The remaining risk is moderate due to low current detection but high potential for rapid escalation as the campaign expands. Continuous monitoring is advised to intercept any payload delivery or secondary infrastructure deployment.