moonshot-tokens[.]fun

The domain moonshot-tokens.fun is flagged as a high-risk brand impersonation of the cryptocurrency exchange OKX. The domain does not appear to host a crypto drainer kit but is suspected of using fake login pages to steal user credentials and access sensitive information. The threat is designed to deceive users into believing they are interacting with a legitimate OKX service, which could lead to financial loss and identity theft.

Infrastructure analysis reveals that moonshot-tokens.fun is flagged by 15 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion among cybersecurity experts. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 188.114.97.3. The domain was created on April 22, 2026, which is a relatively recent date, suggesting it may be part of a targeted campaign. The Gridinsoft trust score for this domain is 0/100, indicating a complete lack of trust. Additionally, the domain appears on three security blocklists, further emphasizing its malicious nature.

The domain is currently offline, which suggests that it has been taken down as part of a response to the detected threat. However, the infrastructure and technical indicators remain concerning, as the domain could be reactivated at any time. Response actions should include monitoring for any signs of the domain coming back online, updating security blocklists, and educating users about the risks associated with fake login pages. Despite the domain being offline, the remaining risk is high, as the infrastructure and creation date indicate a sophisticated and targeted attack. Users should remain vigilant and avoid interacting with any similar domains.