moonsgetv[.]click

Analysis indicates that moonsgetv.click was registered on June 21, 2026 through Global Domain Group LLC and immediately pointed to the Cloudflare edge address 104.21.46.236, which belongs to ASN 13335 (Cloudflare, Inc.) located in the United States. The domain resolves via the Cloudflare nameservers joselyn.ns.cloudflare.com and mitchell.ns.cloudflare.com, confirming that the hosting service is Cloudflare’s CDN platform. TLS termination is performed by Google Trust Services under the WE1 certificate authority, providing a valid HTTPS certificate that may lend credibility to the site. The page title observed during the short live period was “KOL – Vote to list on Moonshot”, and the threat classification is brand impersonation targeting the Moonshot platform.

The site was taken offline before the report was compiled, but during its active window it was listed on three independent security blocklists and was actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show that 11 of 91 security engines flagged the domain as malicious, reinforcing the suspicion of phishing activity. The combination of a recent registration, rapid deployment on a high‑reputation CDN, a valid SSL certificate, and detection by multiple third‑party filters indicates a deliberate attempt to harvest credentials or otherwise deceive users of the Moonshot service. Uncertainty remains regarding the exact payload or credential‑capture mechanisms because the site was unavailable for deeper inspection, and no malware hashes or download URLs have been observed.

Defenders should add moonsgetv.click to local deny lists, monitor DNS queries for the domain and its associated IP address, and enforce blocklist updates that include the three known blocklists. Network‑level filtering of traffic to the Cloudflare IP 104.21.46.236 should be considered only after verifying that legitimate services are not impacted, given the widespread use of Cloudflare.