collab-moonshot[.]com

This domain, collab-moonshot.com, is identified as a high-risk phishing site specializing in brand impersonation targeting Moonshot, a recognized entity in the digital asset space. Analysis indicates the domain is designed to deceive users into disclosing sensitive credentials or transferring assets under false pretenses, likely leveraging social engineering tactics such as fake login portals or fraudulent investment schemes. No explicit drainer kit signatures have been confirmed at this stage, but the domain’s infrastructure aligns with known phishing campaign patterns. Infrastructure analysis reveals the domain resolves to the IP address 172.67.186.16, a host associated with prior malicious activity. It was registered on June 8, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently utilized in phishing operations. Detection metrics show 13 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as phishing sites commonly employ valid certificates to appear legitimate. The domain currently appears on three security blocklists, further corroborating its malicious classification. As of the latest assessment, collab-moonshot.com remains active and unmitigated, posing an ongoing risk to users. While it is blocked by several security frameworks, the domain’s persistence and low detection rate among some vendors suggest it may evade certain automated defenses. Organizations and individuals are advised to implement network-level blocking for the domain and its associated IP address. Users should exercise caution when encountering unsolicited communications referencing Moonshot or related services, particularly those directing traffic to collab-moonshot.com. Continuous monitoring of emerging indicators is recommended to track potential shifts in the campaign’s infrastructure.