moonshot-rate[.]app

Analysis of moonshot-rate.app indicates a high‑risk brand‑impersonation operation that targets the Moonshot brand with a crypto‑scam payload. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (ASN 13335, United States). DNS resolution returns the IPv6 address 2a06:98c1:3120::3 and the authoritative nameservers are dean.ns.cloudflare.com and priscilla.ns.cloudflare.com. An HTTPS request presents a Google Trust Services / WE1 certificate, while the HTTP response code is 403 and the page title returned by Cloudflare reads “Suspected phishing site | Cloudflare”.

The site is currently taken offline, but historical activity shows it was flagged by multiple security products: ten of ninety‑three VirusTotal scanners reported malicious behavior, and the domain appears on four public blocklists, specifically PhishDestroy, MetaMask, ScamSniffer and SEAL. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. AlienVault OTX lists the domain in one threat‑intelligence pulse, confirming community awareness of the threat. No additional payload or page content has been disclosed, so the exact phishing vector remains unknown.

Defenders should continue to block the domain at network perimeter and DNS layers, update intrusion‑detection signatures with the observed IPv6 address and nameserver pattern, and monitor for re‑registration or re‑use of the same infrastructure. Because the domain is presently offline, immediate impact is limited, yet the combination of brand impersonation, crypto‑scam classification and low trust scores suggests a high likelihood of re‑deployment. Ongoing vigilance is recommended.