enter-moons-shot[.]com

Analysis of the domain enter-moons-shot.com shows a recently registered (23 March 2026) site that was used for a fake airdrop scheme. The registrar is Name.com, Inc., and the authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, indicating deployment on the Vercel hosting platform. The domain resolves to IP address 216.150.1.65, which is geolocated to the United States and is owned by Vercel, Inc. An SSL certificate issued by Let’s Encrypt (R12) was present, and HTTP requests returned a 404 status, suggesting the site content was removed or taken offline at the time of analysis. The page title served by the server was simply "enter-moons-shot.com," providing no additional context.

Security telemetry shows the domain is listed on three blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans recorded 13 detections out of 94 security vendors, reinforcing the malicious classification. Independent reputation scoring (Gridinsoft) assigned a trust score of 0 out of 100, and the technology fingerprint identified Vercel, Unpkg, and HTTP Strict Transport Security (HSTS) as present components. The observed indicators collectively point to a high‑risk fake‑airdrop campaign, although the current offline status limits immediate payload observation.

Uncertainty remains regarding the exact phishing landing page content and any credential‑harvesting mechanisms that may have been employed before takedown. Defenders should continue to block the domain at network perimeters, update endpoint and web‑filtering policies to include the listed blocklists, and monitor the associated IP address for any re‑hosting activity. Additional vigilance is advised for any traffic attempting to resolve the domain, as threat actors may repurpose the infrastructure for future campaigns.