moonshot-tool[.]fun

The domain moonshot-tool.fun has been assessed as high risk due to a confirmed brand impersonation threat targeting Moonshot. This type of malicious domain is designed to deceive users into believing they are interacting with a legitimate Moonshot service, potentially leading to credential theft or unauthorized access to sensitive accounts. The domain was flagged by 10 out of 95 security vendors on VirusTotal, indicating widespread recognition of its malicious nature. It also appears on three security blocklists and was linked to one threat intelligence pulse on AlienVault OTX, reinforcing the severity of the threat. The domain was created on April 17, 2026, and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 188.114.97.3 and uses a Let's Encrypt SSL certificate with serial E8. Although the domain is currently offline, its previous activity and the indicators collected suggest a high likelihood of future attempts under similar names. Users should remain vigilant and verify any communication or website claiming to be Moonshot. To mitigate risks associated with brand impersonation, users are advised to always type the official Moonshot URL directly into their browser rather than clicking on links from emails or messages. Enable multi-factor authentication on all Moonshot accounts and report any suspicious domains or messages to the Moonshot security team. Regularly monitor account activity for unauthorized access and consider using a password manager to avoid reusing credentials across sites. By following these steps, users can protect themselves from falling victim to this and similar impersonation attacks.