moonshot-mode[.]lol

The domain moonshot-mode.lol was registered on 30 April 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. and geolocated to Canada. The authoritative name servers are george.ns.cloudflare.com and ada.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services.

The site presents a valid Let’s Encrypt certificate (issuer E8) and serves HTTP status code 403 for direct requests, suggesting an attempt to hide malicious content behind a denial response. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on three independent security blocklists – PhishDestroy, MetaMask, and SEAL – confirming its reputation as a malicious resource. AlienVault OTX lists the domain in a single threat‑intel pulse, and VirusTotal records 15 of 95 scanned security vendors flagging the domain as suspicious.

The primary threat vector is brand impersonation of the legitimate Moonshot brand. The domain name incorporates the target brand name and leverages the same visual branding on the landing page, a pattern consistent with credential‑harvesting campaigns. Its current classification as a high‑risk, active threat aligns with the observed infrastructure and blocklist activity. No additional payloads or command‑and‑control endpoints have been disclosed, leaving the exact malicious functionality uncertain.

Defenders should immediately add moonshot-mode.lol to network and email filtering rules, enforce DNS sink‑holing, and monitor for any connections to the Cloudflare IP 188.114.96.3. Continuous scanning of the certificate and HTTP response is advised to detect any changes in payload delivery. Because the domain leverages a reputable CDN, threat‑intelligence sharing with peers is recommended to accelerate takedown efforts and reduce exposure to brand‑impersonation attacks.