xn--mooshots-rpb[.]com

This domain, xn--mooshots-rpb.com, was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 104.21.54.112 (AS13335, United States). The DNS configuration lists dean.ns.cloudflare.com and priscilla.ns.cloudflare.com as authoritative name servers, indicating that the infrastructure is fully proxied by Cloudflare. An SSL certificate issued by Let’s Encrypt (certificate identifier E7) is active, confirming that TLS termination is provided by the same CDN. Automated analysis observed the page title “Vote to List — Powered by Moonshot,” matching the declared brand target “Moonshot” and the scam classification of brand impersonation.

The site employed the publicly known Wallet Connect Abuse phishing kit, which is commonly used to harvest cryptocurrency credentials. VirusTotal scans returned 12 detections out of 95 security vendors, and the domain is listed on two external blocklists, including PhishDestroy and ScamSniffer. Additional technical fingerprints include Cloudflare’s HTTP/3 support, confirming modern protocol usage. The current operational state is marked as offline, but the presence of the domain on blocklists and the vendor detections suggest that it was actively used for malicious activity prior to takedown.

Uncertainty remains regarding the exact payload delivered to victims, as no page content beyond the title has been publicly disclosed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual traffic to the IP address 104.21.54.112, and correlate logs for Wallet Connect‑related activity. Maintaining the blocklist entries and sharing the indicator set with threat‑sharing communities will help prevent re‑use of the same infrastructure in future impersonation campaigns.