xn--monshot-e0a[.]app

The domain xn--monshot-e0a.app was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently marked as offline. Technical analysis shows the domain resolves to IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. The authoritative nameservers are dean.ns.cloudflare.com and priscilla.ns.cloudflare.com, indicating that the infrastructure is fully hosted on Cloudflare's network and supports HTTP/3. An SSL certificate issued by Let’s Encrypt (certificate identifier E7) is present, providing standard TLS encryption but offering no indication of malicious intent.

HTTP requests to the domain return a 403 status code, suggesting that the site is no longer serving content or is actively denying access. The page title that was captured before the takedown reads "Vote to List — Powered by Moonshot," and the threat classification is listed as brand impersonation targeting the Moonshot brand. The domain appears on three security blocklists, specifically PhishDestroy, MetaMask, and SEAL, and five out of ninety-three VirusTotal scanners flagged the host as malicious.

The overall risk level is elevated, and the current status is offline. Defenders should add xn--monshot-e0a.app to network deny lists, monitor Cloudflare‑hosted punycode domains for similar naming patterns, and maintain vigilance for any re‑registration attempts. Continuous threat‑intel feeds should be consulted for updates, and any inbound connections to the resolved IP should be inspected for anomalous traffic despite the present 403 response.