moonshot-money[.]pro

Analysis identifies moonshot-money.pro as a brand impersonation domain targeting Moonshot. The observed page title, "KOL – Vote to list on Moonshot," indicates an attempt to imitate the legitimate brand and potentially mislead visitors into trusting fraudulent content. The domain is currently in taken_down status, reducing immediate exposure, but its previous activity and infrastructure characteristics remain relevant for historical investigations and future threat correlation.

Technical evidence shows the domain was created on March 18, 2026 and registered through Global Domain Group LLC. Infrastructure analysis resolves the domain to IP address 104.21.82.225. The associated TLS certificate was issued by Let's Encrypt / E7. Security telemetry indicates the domain is flagged by 17 of 95 VirusTotal vendors and appears on 1 security blocklist. The hosting infrastructure is located in CA under Cloudflare, Inc. These indicators collectively support an elevated risk assessment and are consistent with infrastructure commonly associated with short-lived brand impersonation operations.

Although the domain has been taken down, historical indicators should remain retained within defensive monitoring systems to support retrospective investigations and detection engineering. Organizations should continue blocking the recorded domain and associated indicators, monitor for newly registered lookalike domains targeting the same brand, and review historical logs for prior connections to the listed IP address and domain. Users should avoid entering credentials or financial information into domains that imitate trusted brands, verify destinations through official channels, and report similar infrastructure promptly to reduce the effectiveness of future impersonation campaigns.