moonshot-token[.]fun

The domain moonshot-token.fun has been identified as a high-risk brand_impersonation threat targeting the Moonshot cryptocurrency project. Analysis confirms the domain was actively used to mimic official Moonshot branding, as evidenced by the page title 'Moonshot' and its classification under brand impersonation tactics. The domain is currently offline, though prior activity suggests it was operational for malicious purposes. Infrastructure analysis reveals the domain was registered on April 17, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolved to the IP address 188.114.97.3 and was flagged by 15 of 95 security vendors on VirusTotal. Additional threat intelligence sources indicate its presence in one AlienVault OTX pulse and four security blocklists, including MetaMask, PhishDestroy, SEAL, and Maltrail. The domain received a trust score of 0/100 from Gridinsoft, further corroborating its malicious classification. Given the domain's current offline status, no active threat is present; however, the infrastructure remains a potential risk for future misuse. Organizations and users are advised to maintain blocklist entries for this domain and its associated IP. Security teams should monitor for re-registration or re-emergence under similar naming conventions, particularly those referencing cryptocurrency projects. Proactive measures, such as updating detection rules and educating users on brand impersonation tactics, are recommended to mitigate future exposure.