xn--monshot-d0a[.]app

Analysis of xn--monshot-d0a.app shows a high‑risk brand‑impersonation campaign targeting the celer brand. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and immediately resolved to the Cloudflare IP address 104.21.27.126, which belongs to ASN 13335 and is geolocated in the United States. DNS resolution uses Cloudflare nameservers dean.ns.cloudflare.com and priscilla.ns.cloudflare.com, indicating the attacker leveraged Cloudflare's CDN and protection services for hosting. The site presented the page title "Vote to List — Powered by Moonshot," a title that bears no direct reference to celer but aligns with a typical social‑engineering lure.

HTTP responses return a 403 status code, suggesting the content is currently inaccessible, and the domain is reported as taken offline. Despite the offline state, the domain appears on three security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL, confirming its classification as a wallet/seed phishing operation. VirusTotal scans show 12 of 93 security vendors labeling the domain as malicious, reinforcing the threat assessment. AlienVault OTX includes the domain in a single threat‑intelligence pulse, providing additional corroboration.

The SSL certificate is issued by Let’s Encrypt (identifier E8), which does not mitigate the malicious intent. Defenders should immediately block the domain at perimeter and DNS layers, continue monitoring the associated IP address for any reactivation, and advise users never to submit wallet seeds or private keys to any site referencing celer. Ongoing intelligence gathering is required to determine whether the threat actor rehosts the payload elsewhere or re‑uses the same infrastructure for future campaigns.