moonshots-pump[.]net

Analysis of moonshots-pump.net shows a newly registered infrastructure that aligns with a cryptocurrency‑focused impersonation campaign targeting the celer brand. The domain was created on February 21, 2026 and is hosted behind Cloudflare’s AS13335 network, resolving to IP address 172.67.166.174. Both authoritative nameservers, dean.ns.cloudflare.com and priscilla.ns.cloudflare.com, are Cloudflare‑provided, indicating the operator is leveraging a reputable CDN to mask origin. No TLS certificate is presented, leaving HTTP connections unencrypted, a common trait in fast‑deployed scam sites.

The registrar listed as NiceNIC International Group Co., Limited does not provide any protective services, and the Gridinsoft trust score of 0 out of 100 reflects an extremely low reputation. Multiple threat‑intelligence sources have flagged the domain: PhishDestroy, MetaMask, ScamSniffer, and SEAL have blocked it, and VirusTotal reports nine of ninety‑three scanners flagging the host as malicious. The domain appears on four independent blocklists, reinforcing the consensus that it is associated with malicious activity. The observed page title, “Vote to List — Powered by Moonshot,” does not directly reference the celer brand, and no further page content has been captured, leaving the exact visual luring technique unknown.

Given the confirmed impersonation of celer, the crypto‑scam classification, and the convergence of detection signals, defenders should treat moonshots-pump.net as high‑risk. Recommended actions include adding the domain and its resolving IP to outbound and inbound blocklists, updating URL filtering policies, monitoring for derivative domains registered with similar patterns, and ensuring that any internal references to celer‑related services are protected by strict domain whitelisting.