moonshots-pump[.]app

The domain moonshots-pump.app was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335). DNS resolution points to IP address 188.114.97.3, which geolocates to the United States. The domain is configured with Cloudflare nameservers dean.ns.cloudflare.com and priscilla.ns.cloudflare.com, and it does not present an SSL certificate, indicating that HTTPS connections are not encrypted. The site’s page title, "Vote to List — Powered by Moonshot," and the declared scam type of a crypto scam suggest an attempt to lure victims into a voting or listing process, while the intelligence explicitly states that the domain impersonates the brand celer. Multiple security products have flagged the domain.

Gridinsoft assigns it a trust score of 0 out of 100. It is listed on four external blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal analysis shows that 12 of 93 scanning engines returned a positive detection, reinforcing the malicious classification. The domain currently reports an offline status, which may be a tactical takedown or a temporary unavailability; however, the historical evidence of blocklisting and detections indicates a persistent threat.

Defenders should add moonshots-pump.app to network and endpoint blocklists, ensure that DNS filters deny resolution of the domain, and monitor traffic to the associated IP 188.114.97.3 for any residual connections. Because the domain leverages Cloudflare’s network, any attempts to bypass filtering via alternate subdomains should be scrutinized. Organizations that interact with the legitimate celer brand should educate users about the impersonation attempt and verify all communications through official channels. Continuous monitoring of the domain’s registration and hosting attributes is advised, as threat actors may reactivate the domain or spin up new impersonating sites using similar naming patterns.