moonshote-gems[.]com

Analysis of moonshote-gems.com indicates a confirmed crypto scam infrastructure actively impersonating the Moonshot brand. The domain, registered on February 21, 2026, through NiceNIC International Group Co., Limited, resolves to 172.67.182.166 (AS13335, Cloudflare, Inc., US) and presents an HTTP 301 redirect, suggesting it may be part of a larger redirection chain. The page title explicitly displays 'Moonshot,' aligning with the reported brand impersonation. SSL certification is provided by Google Trust Services (WE1), and Cloudflare technologies, including HSTS and HTTP/3, are detected, which are commonly leveraged to obscure hosting origins and enhance perceived legitimacy. Security vendors have flagged this domain, with 12 of 93 engines on VirusTotal identifying it as malicious. It appears on two security blocklists and is explicitly blocked by PhishDestroy and ScamSniffer, further corroborating its classification as a crypto scam. The domain's Gridinsoft trust score of 0/100 reinforces its high-risk status. While the exact mechanics of the scam—such as whether it involves fake token sales, wallet drainers, or fraudulent airdrops—are not yet confirmed, the infrastructure is consistent with known crypto fraud patterns. Defenders should treat this domain as active and high-risk. Immediate actions include blocking resolution at the DNS level, adding the domain and associated IP to firewall deny lists, and monitoring for related subdomains or newly registered lookalike domains. Given the use of Cloudflare, additional scrutiny of traffic patterns to 172.67.182.166 is recommended to identify potential lateral movement or secondary payload delivery. No evidence suggests this campaign has been neutralized, and the domain remains operational as of July 12, 2026.