xn--monshot-2mb[.]app

The domain xn--monshot-2mb.app is a confirmed phishing site engaged in brand impersonation targeting Moonshot. It presents itself as a legitimate Moonshot-related page with the title 'Vote to List — Powered by Moonshot', but its purpose is to deceive users through fraudulent branding. No crypto drainer kit was detected, and the site is currently taken offline, though it previously posed an elevated risk due to its deceptive nature.

Technical analysis shows that xn--monshot-2mb.app was flagged by 4 of 95 security vendors on VirusTotal, including Fortinet, Gridinsoft, and Mimecast. It appears on one security blocklist, PhishDestroy, and was registered through NiceNIC International Group Co., Limited on February 21, 2026. The domain resolves to the IP address 188.114.97.3, hosted on Cloudflare’s infrastructure (AS13335) in the US, and uses an SSL certificate issued by Let’s Encrypt (E8). The site employed Cloudflare services and HTTP/3 technology, with nameservers dean.ns.cloudflare.com and priscilla.ns.cloudflare.com. Google Safe Browsing did not flag the domain at the time of assessment.

Users who interacted with xn--monshot-2mb.app should take immediate action to secure their accounts. If login credentials were entered, change passwords for the affected service and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized activity and report any suspicious transactions. To report the phishing domain, submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG). Victims may also notify Moonshot directly to assist in brand protection efforts.