moonshotx[.]top

The domain moonshotx.top is currently offline but was active as a crypto‑focused impersonation of the Moonshot brand. Registration data shows the domain was created on 26 February 2026 through NiceNIC International Group Co., Limited, and it resolves to the IP address 178.212.12.231, which is hosted in Russia under ASN 62082 (Hostland LTD). No TLS certificate is presented for the site, indicating that any communication would have been unencrypted. The domain is listed on three security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat‑intel feeds have flagged it as malicious.

VirusTotal analysis reports that four out of ninety‑three scanning engines flagged the domain, reinforcing the suspicion of malicious intent. Nameserver records point to a.dnspod.com, b.dnspod.com, and c.dnspod.com, a configuration commonly seen in rapidly provisioned malicious infrastructure. The known scam type is a crypto scam, suggesting that the site likely attempted to lure victims into sending cryptocurrency under the pretense of a legitimate Moonshot service.

While the exact content of the landing page, page title, or Safe Browsing status has not been disclosed, the combination of registration age, hosting location, lack of SSL, blocklist presence, and vendor detections provides a strong indicator of threat. Defenders should continue to block moonshotx.top at network perimeters, update intrusion‑prevention signatures, and monitor for any residual traffic to the associated IP address. Additional investigation of the hosting provider and DNS records may uncover related domains or infrastructure used in the campaign.