quests-moonshot[.]com

This domain, quests-moonshot.com, was registered on February 27 2026 through Hello Internet Corp and resolves to IP 104.21.49.198, hosted behind a CDN. Authoritative nameservers roan.ns.cloudflare.com and tara.ns.cloudflare.com respond for the zone. The site returns an HTTP 301 redirect and presents the page title “Index of /”. TLS is provided by a Let’s Encrypt certificate (E8). Infrastructure fingerprints show Cloudflare Browser Insights and HTTP/3 support. The domain is associated with a crypto‑draining brand‑impersonation campaign targeting Moonshot, as indicated by the listed scam type and brand target. Reputation signals are poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on three public blocklists, has been blocked by PhishDestroy, MetaMask and SEAL, and is referenced in 24 AlienVault OTX pulses. VirusTotal analysis shows five of ninety‑three scanners flag the domain. Current evidence does not reveal the exact landing page content beyond the generic index title, so the specific malicious payload remains unknown. Defenders should block the domain at network and DNS layers, monitor for related indicators such as the IP address and the two nameservers, and advise users to avoid any unsolicited communications claiming to be from Moonshot that reference this domain. Ongoing telemetry should be collected to confirm whether the site begins serving active crypto‑scam payloads.