moonshot-push[.]com

Analysis as of July 24, 2026 identifies moonshot-push.com as an active crypto‑scam infrastructure that impersonates the Moonshot brand. The domain was registered through Tucows Domains Inc. on 21 February 2026 and resolves to the Cloudflare‑owned address 188.114.97.3 (AS13335, United States). DNS is served by Cloudflare name servers darwin.ns.cloudflare.com and michelle.ns.cloudflare.com, and the site is protected by a Google Trust Services / WE1 SSL certificate, indicating use of Cloudflare’s CDN and HTTP/3 support. An HTTP 301 redirect is observed, and the page title returned by the server reads “Moonshot vote – All Chains”, which aligns with the reported brand impersonation. Reputation signals are strongly negative.

The domain appears on four independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal scans show that 2 of 93 AV engines flagged the domain, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0/100, confirming the lack of benign reputation. No additional public threat‑intel (OTX, Safe Browsing) is referenced in the current feed. The combination of recent registration, Cloudflare‑based hosting, brand‑specific page title, and multiple blocklist entries indicates a purposeful campaign to lure cryptocurrency users, likely by presenting a voting interface for “All Chains” to harvest private keys or seed phrases.

The precise payload or credential‑capture mechanism has not been observed, so the exact user‑interaction flow remains uncertain. Defenders should block DNS resolution for moonshot-push.com at the network perimeter, add the domain to web‑filter deny lists, and monitor outbound connections to the associated Cloudflare IP range. Endpoint security solutions should be updated to flag any URLs containing the observed page title or the “Moonshot vote” string.