moonlisting[.]click

Analysis of moonlisting.click was conducted on 24 July 2026. The domain was registered on 15 June 2026 through Global Domain Group LLC and resolves to IP 172.67.160.64, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The site employed Cloudflare’s DNS service, using the authoritative nameservers fiona.ns.cloudflare.com and lennon.ns.cloudflare.com, and presented an SSL certificate issued by Google Trust Services under the WE1 designation, indicating a valid TLS connection at the time of observation. The web page returned the title “KOL – Vote to list on Moonshot”, explicitly referencing the Moonshot brand and thereby constituting a brand‑impersonation campaign. The front‑end stack was identified as AngularJS on top of Cloudflare Browser Insights, with traffic served over HTTP/3, confirming the use of modern web technologies but also revealing reliance on a widely available hosting platform.

VirusTotal recorded 14 detections out of 91 scanned security vendors, reflecting moderate consensus among automated scanners that the domain is malicious. The domain is listed on three public blocklists and appears in a single AlienVault OTX pulse, providing additional community‑derived intelligence. Commercial anti‑phishing products PhishDestroy, MetaMask, and SEAL have also classified the domain as malicious and are actively blocking it. The current operational status is offline, suggesting that the phishing infrastructure has been taken down or is otherwise non‑functional. However, the underlying infrastructure—Cloudflare‑hosted IP address and a globally recognized registrar—remains reusable, allowing the adversary to recreate a similar site with minimal effort.

No additional page content, login forms, or payloads have been disclosed in the intelligence feed, leaving the exact user‑interaction flow uncertain.