s15-moonshot[.]xyz

Analysis of www.s15-moonshot.xyz indicates that the site was taken offline prior to the report date of July 25 2026. The domain was registered on March 06 2026 through Name.com, Inc., and uses Vercel’s DNS infrastructure (ns1.vercel-dns.com, ns2.vercel-dns.com). DNS resolution points to IP 216.150.16.1, an address owned by Amazon.com, Inc. (AS16509) located in the United States. Technical fingerprinting shows the presence of Vercel, Unpkg, and HTTP Strict Transport Security (HSTS) headers, but the site does not present a valid SSL/TLS certificate, leaving HTTP traffic unencrypted. The page title returned from the live endpoint before takedown reads “Vote to List — Powered by Moonshot”, which directly references the Moonshot brand and aligns with the reported brand‑impersonation intent.

The threat classification is listed as a crypto‑related scam, though the exact monetary mechanism has not been captured in the available evidence. VirusTotal analysis recorded three positive detections out of ninety‑four scanning engines, and the domain appears on a single public blocklist, currently identified by PhishDestroy. No additional public threat‑intel feeds (e.g., OTX, Safe Browsing) have been reported for this indicator. The limited detection surface suggests that the site had a brief operational window before removal, reducing exposure time but still posing a risk to users who may have accessed the page during its active period.

Defenders should update domain‑based blocklists to include www.s15-moonshot.xyz and enforce outbound filtering for connections to the associated IP address 216.150.16.1. Because the site lacked TLS, network‑level inspection can capture the HTTP payload without decryption. Monitoring for newly registered domains that combine the “moonshot” keyword with Vercel DNS patterns may provide early warning of repeat campaigns.