moonshot-rank[.]xyz

Analysis of moonshot-rank.xyz shows a newly registered (21 Feb 2026) domain hosted on Cloudflare infrastructure (ASN 13335) with the IP address 104.21.91.53 located in the United States. The domain resolves to a web server that presents the page title “Vote to List — Powered by Moonshot” but does not provide an SSL/TLS certificate, indicating that any communication would occur over unencrypted HTTP. Registration was performed through NiceNIC International Group Co., Limited and the authoritative nameservers are hadlee.ns.cloudflare.com and jaxson.ns.cloudflare.com. Reputation scoring from Gridinsoft assigns a zero‑out‑of‑100 trust rating, reflecting a high‑confidence malicious profile.

The domain appears on two public security blocklists and has been explicitly blocked by PhishDestroy and ScamSniffer. VirusTotal scans report that eight of ninety‑three security vendors flag the domain as malicious, reinforcing the suspicion. The threat is categorized as a crypto scam that impersonates the brand “celer,” aligning with the supplied brand‑target indicator.

Current operational status is offline, but the historical presence on blocklists and the low trust score suggest that the site was used for fraudulent activity before takedown. Uncertainty remains regarding the specific payload or cryptocurrency addresses used, as no additional content analysis is provided. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the IP address or Cloudflare‑hosted subdomains, and update internal threat intelligence feeds with the observed indicators (domain name, IP, nameservers, registration details, and blocklist listings).