xn--monshots-n3a[.]com

Analysis of the domain xn--monshots-n3a.com indicates a high-risk brand impersonation campaign targeting Moonshot, a detail confirmed by the page title 'Vote to List — Powered by Moonshot' and the explicit classification of the scam type as brand impersonation. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with suspicious infrastructure. Infrastructure analysis reveals the domain resolves to the IP address 172.67.197.229, hosted on Cloudflare's network (AS13335) in the United States, a common tactic to obscure origin and leverage Cloudflare's security features to evade detection. The domain was flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, demonstrating cross-industry recognition of its malicious nature. At the time of assessment, the domain appears offline, though its prior activity and detection status warrant continued monitoring.

The SSL certificate, issued by Let's Encrypt (serial number E8), provides encrypted communication but does not validate legitimacy, as phishing domains routinely employ valid certificates to appear trustworthy. Detection engines on VirusTotal flagged the domain as malicious, with 13 of 93 security vendors marking it as suspicious. While this detection rate is notable, it does not represent exhaustive analysis, as some vendors may not have updated signatures or may classify the domain differently. The domain's nameservers, dean.ns.cloudflare.com and priscilla.ns.cloudflare.com, further confirm its reliance on Cloudflare's infrastructure, a pattern observed in both legitimate and malicious domains.

Defenders should treat this domain as confirmed malicious due to its brand impersonation of Moonshot, blocklist inclusions, and detection by multiple security vendors. Network-level blocking of the IP 172.67.197.