app-moonshots[.]com

app-moonshots.com is currently active and has been classified as a brand‑impersonation campaign targeting the Moonshot brand. The domain resolves to 188.114.97.3, a CDN edge node located in Canada, and uses the provider’s DNS servers fattouche.ns.cloudflare.com and melissa.ns.cloudflare.com. The web application is built on a Node.js runtime with an Express framework and advertises browser‑insights and HTTP/3 support. TLS is supplied by a free certificate issued by Let’s Encrypt under the E7 identifier. Registration was recorded on 24 April 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The observed page title, “Vote to List — Powered by Moonshot”, demonstrates an attempt to leverage the Moonshot brand name. The domain appears on two security blocklists (PhishDestroy, ScamSniffer) and receives a Gridinsoft trust score of 0 / 100. VirusTotal scans indicate that 20 of 91 security vendors flag the domain as malicious. An HTTP 301 redirect is observed, but the final landing page content has not been captured. The evidence confirms active impersonation infrastructure, while the exact payload or credential‑harvesting mechanisms remain unknown. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the associated CDN IP, and consider sinkholing the domain to disrupt traffic. Continuous re‑evaluation is advised as additional intelligence, such as page content or user reports, becomes available.