xn--monshots-w3a[.]app

This technical threat report analyzes the domain xn--monshots-w3a.app, which presented a page titled "Vote to List — Powered by Moonshot." The site was configured as an impersonation of the brand Moonshot, falling under the scam type of impersonation. The threat posed is that users visiting this domain may have been misled into believing they were interacting with a legitimate Moonshot service, potentially leading to credential theft or unauthorized actions under the guise of a voting or listing activity.

Technical evidence from the provided data confirms the malicious nature of this domain. VirusTotal analysis shows 10 out of 95 vendors flagged the site as malicious, with detections from ADMINUSLabs, alphaMountain.ai, CRDF, CyRadar, and Fortinet. The domain is registered with NiceNIC International Group Co., Limited, and was created on February 21, 2026. It resolves to IP address 172.67.140.155 in the United States, hosted by AS13335 Cloudflare, Inc., and uses SSL certificate issuer Let's Encrypt / E7. The nameservers are dean.ns.cloudflare.com and priscilla.ns.cloudflare.com. The domain appears on 3 blocklists.

As of the current assessment, the domain is reported as DOWN or OFFLINE, indicating it is no longer accessible. The risk level is considered high due to the impersonation of a known brand and the multiple security vendor flags, though the immediate threat is mitigated by its offline status.