noti-moonshot[.]com

Analysis of www.noti-moonshot.com, first observed on March 03, 2026, shows a short‑lived infrastructure designed to mimic the Moonshot brand for a cryptocurrency‑related scam. The domain is registered through Name.com, Inc. and is hosted on Vercel’s edge platform, as indicated by the detected Vercel technology stack and the authoritative nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. The site served an HTTP 404 response with the page title "404: NOT_FOUND" before being taken offline, and current network probes confirm the domain resolves to the IP address 216.150.1.129, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Transport security is provided by a Let’s Encrypt certificate (R12), and the presence of HTTP Strict Transport Security (HSTS) further confirms a modern TLS configuration.

VirusTotal records indicate that five of ninety‑four security‑vendor scanners flagged the domain, suggesting malicious behavior was detected by a minority of AV engines. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service, reinforcing the classification as a threat. The scam type is explicitly labeled as a "Crypto Scam," and the brand target is Moonshot, confirming a brand‑impersonation motive.

Defenders should treat any traffic to www.noti-moonshot.com as malicious. Existing security controls should block the domain at the DNS, proxy, and endpoint layers, and any endpoints that have communicated with the IP 216.150.1.129 should be investigated for potential credential theft or crypto‑wallet compromise. Because the site is currently offline, retrospective analysis of logs is required to determine the exact time window of activity and to capture any payloads or redirects that may have been served before the 404 response. Continuous monitoring of the registrar Name.com and the Vercel hosting environment is advised, as the attacker could redeploy a similar site under a new subdomain or domain.