next-moon[.]fun

The domain next-moon.fun has been identified as an elevated risk due to its involvement in brand impersonation, specifically targeting Google. The threat type has been classified as brand impersonation, which poses a significant risk to users who may be misled into providing sensitive information under the guise of interacting with a trusted entity. The use of Google's name in the page title suggests a deliberate attempt to deceive users.

Technical analysis of next-moon.fun reveals several critical indicators of malicious activity. The domain resolves to the IP address 104.21.85.217 and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com. This domain is currently listed on one security blocklist, specifically flagged by PhishDestroy, and VirusTotal reports a detection rate of 1 out of 95 security vendors. The domain was created on February 21, 2026, and is currently offline. The page title "Google" signals clear intent to impersonate the brand, thereby increasing the threat level associated with this domain.

To mitigate the risks associated with this type of brand impersonation, it is recommended that users remain vigilant and verify the authenticity of web pages claiming to represent established brands like Google. Organizations should employ email filtering and web filtering solutions to block access to domains identified as malicious. Additionally, educating users about the common tactics used in brand impersonation attacks can help reduce the likelihood of successful phishing attempts. It is crucial for security teams to monitor for any new domains that may arise with similar characteristics in order to preemptively block potential threats.