xn--monshots-x6c[.]com

The domain xn--monshots-x6c.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited. Its authoritative name servers are dean.ns.cloudflare.com and priscilla.ns.cloudflare.com, indicating that the domain is hosted on Cloudflare’s network. DNS resolution points to IP address 172.67.217.92, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate was observed for the host, suggesting that HTTPS was not offered at the time of analysis.

The site presented the page title “Vote to List — Powered by Moonshot,” and is classified as a crypto‑scam that impersonates the brand “celer.” The domain has been flagged by two independent anti‑phishing services, PhishDestroy and ScamSniffer, and appears on two security blocklists. VirusTotal scans returned four positive detections out of ninety‑five submitted scanners. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100. As of the report date, the domain is reported as taken offline, limiting direct observation of payload or content.

The available evidence points to a short‑lived infrastructure that leveraged Cloudflare’s DNS and CDN services to hide the origin of the malicious host while targeting users interested in cryptocurrency voting mechanisms. Defenders should continue to block the resolved IP address and the domain name at perimeter filters, add the host to internal threat intelligence feeds, and monitor for any re‑registration attempts or similar punycode variations. Ongoing vigilance is advised because the underlying infrastructure—particularly the Cloudflare edge IP—may be reused for future campaigns targeting the same brand or related crypto‑related services.