event-moonshot[.]com

The domain event-moonshot.com was registered on March 04, 2026 through Hello Internet Corp and immediately began hosting a site that mimics the legitimate Moonshot brand. The site is designed to lure victims into a cryptocurrency‑related scheme, a classic pattern for brand‑impersonation attacks targeting investors and users of the authentic service.

Infrastructure analysis shows the domain is served entirely behind Cloudflare’s network (AS13335) and resolves to IP address 104.21.80.77, located in the United States. DNS is delegated to fred.ns.cloudflare.com and sasha.ns.cloudflare.com, confirming the use of Cloudflare’s authoritative nameservers. The site presents a Let’s Encrypt certificate (E7) and responds with an HTTP 301 redirect, while advertising HTTP/3 support. The page title returned is "Index of /", a generic directory listing that provides no legitimate content and is commonly employed to conceal malicious payloads.

Reputation signals reinforce the malicious classification. VirusTotal analysis records three out of ninety‑five security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple downstream security controls have identified it as a threat. The combination of a low trust score, vendor flags, and blocklist presence demonstrates a high likelihood of abusive activity.

Given the confirmed brand‑impersonation intent and the cryptocurrency scam vector, defenders should immediately block event-moonshot.com at the network perimeter and within endpoint protection policies. Security teams are advised to monitor DNS queries for the domain and its associated Cloudflare nameservers, and to alert users about the counterfeit Moonshot branding. Continuous re‑evaluation is recommended as threat actors may adapt the infrastructure, but current evidence strongly supports a high‑risk, active status.