moonjoin[.]rest

The domain moonjoin.rest was registered on June 22, 2026 through Global Domain Group LLC and is presently taken offline. Infrastructure analysis shows the domain resolves to the IP address 172.67.174.27, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. The authoritative nameservers are rayne.ns.cloudflare.com and tom.ns.cloudflare.com, confirming Cloudflare as the DNS provider. TLS termination is performed by a certificate issued to Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint at the time of observation. Web‑technology fingerprinting reveals the presence of AngularJS, Cloudflare Browser Insights, and support for HTTP/3, consistent with a modern web application stack hosted behind Cloudflare’s edge network.

Threat intelligence indicates that the site presented the page title "KOL – Vote to list on Moonshot," directly referencing the Moonshot brand. This aligns with the reported threat type of brand impersonation, suggesting an attempt to solicit user interaction under the guise of a legitimate Moonshot‑related campaign. The domain appears on three security blocklists and has been flagged by the PhishDestroy, MetaMask, and SEAL blocklist providers. VirusTotal analysis recorded three positive detections out of ninety‑one scanned scanners, reinforcing the malicious classification.

While the site is no longer reachable, the combination of brand‑specific page title, Cloudflare‑hosted infrastructure, and multiple blocklist entries provides sufficient evidence for defensive action. Security teams should update URL filtering policies to block moonjoin.rest, incorporate the associated IP address 172.67.174.27 into network‑level deny lists, and monitor for any future domains that resolve to the same Cloudflare AS or employ similar AngularJS‑based front‑ends targeting Moonshot users.