moonshot-ca[.]xyz

PhishDestroy identifies an active brand impersonation domain, moonshot-ca.xyz, currently impersonating Moonshot as part of a targeted phishing campaign. The domain is classified under the specific threat type of brand impersonation and remains in active status, posing an elevated risk to users expecting legitimate Moonshot services.

This domain was flagged by 1 of 95 VirusTotal security vendors, indicating limited but present detection. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 188.114.97.3. The domain was created on April 29, 2026, and currently shows no presence on public blocklists. The SSL certificate is issued by Let's Encrypt, which may enhance its perceived legitimacy despite malicious intent. Trust scores remain unverified due to the domain's recent creation.

As of the latest intelligence, moonshot-ca.xyz continues to operate with an elevated risk profile. Organizations and users are advised to block this domain at the network and endpoint levels. Avoid accessing or interacting with any content hosted on this domain. Report any observed activity to security teams and update threat intelligence feeds to include this indicator. Users should verify URLs carefully and rely on official Moonshot domains for secure access.