app-moonshot[.]xyz

This domain is flagged for brand impersonation targeting Moonshot in a cryptocurrency scam context. Registered through Dynadot LLC on March 13 2026 the domain app-moonshot.xyz resolves to IP address 104.21.46.72 located in the United States under AS13335. Nameservers listed are millie.ns.cloudflare.com and randy.ns.cloudflare.com with an SSL certificate issued by Let's Encrypt under serial E8. Infrastructure analysis reveals Cloudflare and HTTP/3 technologies in use while the domain maintains active status as of the July 12 2026 report date.

Detection evidence includes appearance on three security blocklists with explicit blocks recorded from PhishDestroy MetaMask and SEAL. VirusTotal reports indicate one out of 95 vendors flags the domain. HTTP status returns 403 and the observed page title reads app-moonshot.xyz | 504: Gateway time-out. The combination of recent registration high risk classification and cryptocurrency targeting supports the brand impersonation assessment without reliance on unlisted external factors.

Uncertainties remain around the precise operational intent beyond the documented impersonation and scam type as no additional payload or redirect chains are recorded in available intelligence. The gateway time-out title and 403 response suggest possible configuration changes or defensive measures already applied by the hosting provider yet the domain continues to resolve and appears on blocklists.

Defenders should incorporate the exact IP 104.21.46.72 and nameserver pair into monitoring rules along with the domain string itself. Regular checks against the three known blocklists and verification of Let's Encrypt certificate issuance for similar patterns are advised. Blocking at DNS or network levels based on the documented evidence reduces exposure to this active impersonation infrastructure.