news-moonshots[.]com

The domain news-moonshots.com is currently listed as an active high‑risk brand‑impersonation infrastructure targeting the Moonshot brand. Automated detection services have flagged the domain, with PhishDestroy, MetaMask, and SEAL confirming its malicious status. The domain also appears on three external blocklists, indicating that multiple independent threat‑intelligence feeds have incorporated it into their deny lists. VirusTotal scans show that 16 of 91 security vendors return a positive detection for the host, reinforcing the consensus that the site is being used for malicious purposes.

The primary indicator of compromise is the explicit claim that the site impersonates Moonshot, as recorded in the intelligence feed. No additional metadata such as SSL certificate details, hosting IP, ASN, or page title has been released, so the underlying infrastructure remains partially opaque. The lack of a published page title suggests that content analysis has not yet been performed, or that the page employs dynamic rendering to evade static inspection.

Defenders should prioritize immediate containment of the domain within perimeter controls. Adding news-moonshots.com to DNS blocklists, firewall deny lists, and secure web‑gateway policies will mitigate inadvertent user exposure. Continuous monitoring of the domain for any changes in hosting or certificate ownership is advised, as threat actors frequently shift infrastructure to evade takedown efforts. Organizations that use the Moonshot brand should also educate users about potential credential‑harvesting attempts that reference the brand, and enforce multi‑factor authentication to reduce impact if credentials are compromised. Since the domain is already flagged by major blocklist providers, integrating those feeds into SIEM correlation rules will improve detection of related traffic and support rapid response to any observed infection vectors.