moonshot-it[.]com

This domain, moonshot-it.com, was identified as a brand impersonation threat targeting users of Celer Network, a blockchain interoperability protocol. The site likely attempted to deceive visitors into entering sensitive credentials, such as wallet private keys, recovery phrases, or login details, by mimicking Celer’s official branding and interface. Such impersonation attacks are commonly used to facilitate unauthorized access to cryptocurrency assets or personal accounts, leading to financial loss or identity compromise.

Analysis indicates the domain was registered on November 8, 2025, through Web Commerce Communications Limited, a registrar often associated with high-risk domains. It resolved to the IP address 185.245.34.139, hosted under AS400992 (ZhouyiSat Communications), an autonomous system with a history of hosting malicious infrastructure. The domain’s SSL certificate, issued by Let’s Encrypt (serial number E8), provided a false sense of security while being flagged by 14 out of 95 security vendors on VirusTotal. Additionally, it appeared on one security blocklist and was subsequently taken offline, though its prior activity remains a concern for potential victims.

If you visited moonshot-it.com or interacted with its content, immediate action is required. First, revoke any permissions granted to the site in browser-based wallet extensions or decentralized applications. Second, scan your device for malware using updated security tools, as phishing sites may deploy malicious payloads. Third, monitor your accounts and transactions for unauthorized activity, particularly if you entered credentials or connected a wallet. Consider reporting the incident to relevant platforms, such as Celer Network’s official security channels, to aid in tracking and mitigating further threats.