moonshot-alphas[.]net

Analysis of moonshot-alphas.net indicates that the infrastructure was actively serving a brand‑impersonation page targeting Moonshot users before being taken offline. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare, resolving to 172.67.131.109, which belongs to AS13335 Cloudflare, Inc. in the United States. The TLS certificate is issued by Google Trust Services under the WE1 designation, confirming use of a legitimate certificate authority. The site returned HTTP 403, suggesting that requests were blocked at the web server level.

The observed page title, “Vote to List — Powered by Moonshot,” aligns with the declared brand target and the wallet/seed phishing classification. Detection tooling has flagged the domain: PhishDestroy, MetaMask, ScamSniffer, and SEAL have listed it as malicious, and VirusTotal shows 11 of 95 security vendors marking the domain as harmful. The domain appears on four public blocklists and is referenced in a single AlienVault OTX pulse. Nameserver records point to dean.ns.cloudflare.com and priscilla.ns.cloudflare.com, consistent with the Cloudflare hosting.

While the exact phishing payload or credential‑capture mechanisms have not been captured, the convergence of multiple independent detections, the presence of a reputable SSL certificate, and the 403 response collectively indicate a high‑confidence malicious operation. Defenders should immediately block the domain and its associated IP address at perimeter and DNS layers, add the nameservers to watch lists, and monitor for any resurgence of similar Cloudflare‑hosted domains created after February 2026 that use comparable page titles. Continuous threat‑intel feeds should be consulted for updates, and any user reports referencing “Vote to List” or Moonshot‑related branding should be treated as suspicious.