moonshot-boost[.]com

Analysis of moonshot-boost.com indicates a high‑confidence brand‑impersonation operation targeting the Moonshot brand. The domain was registered through Hello Internet Corp on 17 November 2025 and currently resolves via Cloudflare nameservers julissa.ns.cloudflare.com and lennox.ns.cloudflare.com to the IP address 104.21.13.200, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No SSL certificate is presented, and the site returns an offline HTTP status at the time of assessment, suggesting the payload has been taken down or is temporarily inaccessible. The page title returned from the server is simply "Moonshot," matching the targeted brand name.

Infrastructure reputation is extremely poor, with a Gridinsoft trust score of 0 out of 100. The domain appears on two independent security blocklists, PhishDestroy and ScamSniffer, and VirusTotal reports that four of ninety‑three scanning engines flag the domain as malicious, reinforcing the suspicion of abusive activity. The listed scam type is a crypto scam, consistent with the brand‑impersonation intent.

While the exact phishing page content has not been captured, the combination of registrar data, Cloudflare hosting, lack of TLS, low trust score, blocklist listings, and vendor detections provides sufficient evidence for defensive action. Security teams should block the domain at network perimeter, update URL filtering policies, and monitor the associated IP address for any future malicious activity. Continued observation of DNS and SSL changes is advised, as the threat actor may reactivate the site or shift infrastructure.