xn--monshots-0rb[.]app

Analysis indicates that the domain xn--monshots-0rb.app was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The domain resolves to 104.21.61.46, an address owned by Cloudflare, Inc. (ASN 13335) and is served from the United States. Cloudflare’s own nameservers dean.ns.cloudflare.com and priscilla.ns.cloudflare.com are configured for the zone, and the site is protected by a Let’s Encrypt certificate (issuer E7) that supports HTTP/3. The only visible page title returned before the site was taken offline reads “Vote to List — Powered by Moonshot”, directly referencing the legitimate brand Moonshot.

The listed brand target and the scam type “Brand Impersonation” align with the observed title, suggesting the domain was intended to masquerade as an official Moonshot service. Reputation checks show that the domain appears on a single security blocklist and is listed by the PhishDestroy blocklist as a confirmed brand‑impersonation site. VirusTotal scans have returned detections from three of ninety‑three antivirus or URL‑reputation engines, reinforcing the malicious classification. No additional public threat‑intel feeds such as OTX or Google Safe Browsing are cited in the available data.

The current operational status is offline, which may indicate the operators have withdrawn the site or are rotating infrastructure. Because the domain is actively associated with Moonshot brand impersonation and has already triggered multiple vendor detections, defenders should continue to treat it as malicious. Recommended actions include adding the domain to internal deny lists, monitoring for any future DNS resolution changes, and correlating any inbound traffic to the 104.21.61.46 address with user‑reported phishing attempts. Analysts should also watch for newly registered punycode variants that could target the same brand, and consider sharing the indicator set with upstream threat‑sharing communities.