moonshot-collab[.]com

The domain www.moonshot-collab.com has been identified as a brand impersonation threat targeting Moonshot, a recognized entity in the cryptocurrency or technology sector. Analysis indicates the domain is currently offline, though prior activity suggests malicious intent to deceive users by mimicking legitimate Moonshot branding. The page title, "Vote to List — Powered by Moonshot," reinforces the impersonation attempt, likely aimed at credential theft or fraudulent engagement. Infrastructure analysis reveals the domain was registered on May 28, 2026, through Name.com, Inc., and resolves to the IP address 216.150.1.129. It appears on one security blocklist and is flagged by 14 of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt, a common but not inherently trustworthy provider for malicious domains. Technologies detected include Vercel, Unpkg, and HSTS, which may have been leveraged to enhance the appearance of legitimacy while masking malicious intent. The domain has been taken offline, reducing immediate risk, but historical indicators suggest it was part of a broader impersonation campaign. Organizations and users are advised to block the domain and IP at the network level, monitor for related indicators of compromise, and verify any communications claiming affiliation with Moonshot through official channels. Security teams should review logs for prior interactions with this domain and investigate potential credential exposure or unauthorized access attempts.