moonshot-alert[.]fun

The domain moonshot-alert.fun has been identified as an active brand impersonation threat targeting the brand Moonshot. Analysis indicates that the domain was created on March 6, 2026, and is currently still active. The domain has been flagged by 6 out of 95 security vendors on VirusTotal, suggesting a notable level of concern among cybersecurity professionals regarding its potential malicious activity. Further investigation reveals that the domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar that has been associated with various malicious registrations in the past.

The current IP address associated with moonshot-alert.fun is 104.21.11.48. This IP has been noted in the threat intelligence community, being included in 23 threat intelligence pulses on AlienVault OTX, highlighting its association with suspicious activities. The domain has a Gridinsoft trust score of 0 out of 100, indicating a complete lack of trustworthiness. Additionally, it has been blocked by multiple security entities, including ScamSniffer, PhishDestroy, and BLP-Malware, which further corroborates the domain's malicious intent.

The page title for the site is "Just a moment...", which is often utilized in phishing scenarios to create a sense of legitimacy or to delay user actions. It is worth noting that moonshot-alert.fun appears on three security blocklists, reinforcing its categorization as a threat. Defenders should take immediate action to block this domain and educate users about the risks associated with clicking on links from unknown or suspicious sources. Monitoring for any attempts to exploit the brand Moonshot through this domain is also advised, given its high risk level and active status.