xn--monshots-w6c[.]net

This domain, xn--monshots-w6c.net, is flagged as a brand impersonation phishing site targeting Celer, a blockchain interoperability platform. The page title, "Vote to List — Powered by Moonshot," suggests an attempt to mimic legitimate governance or listing portals, potentially luring victims into interacting with malicious smart contracts or credential harvesting forms. No specific drainer kit signatures were identified in the available data, but the infrastructure aligns with common phishing tactics used in cryptocurrency-related scams.

Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusually future-dated creation that may indicate a data entry error or intentional obfuscation. It resolves to the IP address 104.21.91.230, a Cloudflare-associated endpoint often leveraged to mask hosting origins. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on two security blocklists, including ScamSniffer and PhishDestroy, and was not detected in Google Safe Browsing at the time of analysis.

The domain is currently offline, reducing immediate exposure risk. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. Organizations should monitor for re-emergence, block the domain and associated IP at the network level, and educate users about brand impersonation tactics targeting cryptocurrency platforms. The future-dated registration warrants further scrutiny to determine if it represents a broader trend or an isolated anomaly.