apps-moonshot[.]net

The domain apps-moonshot.net was registered on 13 April 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently flagged as high‑risk brand‑impersonation targeting the Moonshot brand. The site returns an HTTP 301 status and presents the generic directory listing “Index of /” as its page title. The SSL certificate is issued by Let’s Encrypt (CN=E7), confirming that the domain is reachable over HTTPS. Infrastructure analysis shows the domain resolves to the Cloudflare edge address 172.67.169.102, which is associated with Cloudflare, Inc. in Canada. The domain is served via Cloudflare’s network, leveraging HTTP/3 and the authoritative name servers chip.ns.cloudflare.com and marjory.ns.cloudflare.com. These characteristics are typical of CDN‑based phishing hosting, and the use of Cloudflare obscures the true origin of any backend server. Open‑source intelligence indicates the domain appears on a single security blocklist and is listed in an AlienVault OTX pulse. PhishDestroy has also blocked the domain. VirusTotal scans have resulted in 16 out of 95 security vendors flagging the domain as malicious, reinforcing the high‑risk assessment. No additional artifacts such as a phishing kit, credential‑harvesting form, or malicious payload have been recovered from the initial response, leaving the exact payload delivery mechanism uncertain. Defenders should add apps-moonshot.net to URL filtering and DNS‑sinkhole lists, and monitor for any new sub‑domains or variations that may be generated under the same registration. Given the use of Cloudflare, traffic analysis at the edge may be limited; however, the observed 301 redirect suggests that the site may eventually forward victims to a credential‑collection page. Continuous re‑evaluation of the domain’s content and periodic VirusTotal re‑scans are recommended to capture any evolution of the threat.