xn--monshots-z80d[.]com

Analysis of xn--monshots-z80d.com shows a newly registered domain (creation date 21 February 2026) that is currently offline and returns HTTP 403. The domain resolves to the Cloudflare address 188.114.97.3, belonging to ASN 13335 (Cloudflare, Inc.) in the United States. DNS is served by dean.ns.cloudflare.com and priscilla.ns.cloudflare.com, confirming the use of Cloudflare’s edge infrastructure. The site presents an SSL certificate issued by Let’s Encrypt (identifier “E7”), indicating a valid TLS configuration despite the offline status. Threat intelligence indicates the domain is being used for brand impersonation of the “Moonshot” brand, as reflected in the page title “Vote to List — Powered by Moonshot”.

VirusTotal scans have resulted in eight detections out of ninety‑five security vendors, demonstrating a measurable level of malicious classification. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. The registrar listed is NiceNIC International Group Co., Limited, a known registrar that does not provide additional protective controls. The combination of a recent registration, Cloudflare hosting, a valid TLS certificate, and multiple vendor detections suggests a purposeful attempt to leverage the Moonshot brand for fraudulent purposes.

However, because the site currently returns a 403 response and is marked offline, the exact content and attack vector remain unknown. Defenders should treat the domain as a confirmed brand‑impersonation threat, update web‑filter and DNS block lists to include the domain and its resolving IP, and monitor for any future changes in HTTP response or content. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advisable to capture additional detections if the site becomes active again. Logging of any outbound connections to 188.114.97.