qr-moonshot[.]com

qr-moonshot.com was registered on June 07, 2026 through Name.com, Inc. Within days of creation the domain appeared on three public security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show that 17 of 91 security vendors have raised detections against the domain, indicating a significant malicious signal despite the majority of scanners remaining clean. The blocklist presence and vendor detections together classify the domain as a high‑risk phishing infrastructure.

No additional intelligence such as hosting IP, ASN, or SSL certificate details has been released, and the page title or any landing‑page content has not yet been analyzed publicly. The lack of deeper infrastructure data limits attribution, but the early detection pattern suggests a purposeful campaign aimed at credential harvesting or wallet compromise. Defenders should immediately add qr-moonshot.com to DNS and web‑proxy deny lists, enforce safe‑browsing controls, and monitor outbound connections for any attempts to resolve the domain.

Security teams should also consider enriching future observations with passive DNS, SSL‑certificate transparency logs, and sandbox analysis to capture potential payloads if the site begins serving malicious content. Ongoing observation is advised, as the domain remains active and may evolve its tactics.