moonshots-x[.]fun

The domain moonshots-x.fun has been identified as a brand impersonation threat, specifically targeting the Moonshot brand. This phishing domain was designed to deceive users into believing they are interacting with legitimate Moonshot services, potentially leading to credential theft or other malicious activities. The threat type is categorized as brand_impersonation, and no specific drainer kit has been associated with this domain.

Technical indicators from the investigation reveal that moonshots-x.fun was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on April 18, 2026. The domain resolves to IP address 104.21.12.94 and uses an SSL certificate issued by Let's Encrypt (E8). VirusTotal reports that only 1 out of 95 security vendors flag this domain as malicious, indicating low detection coverage. Additionally, it appears on three security blocklists and is listed in one threat intelligence pulse on AlienVault OTX. The domain is currently offline, but it was previously active.

As of the latest assessment, moonshots-x.fun has been taken offline, reducing immediate risk to users. However, the low detection rate on VirusTotal and presence on blocklists suggest that similar domains may emerge. Users are advised to remain vigilant and avoid clicking on unsolicited links claiming to be from Moonshot. If users encounter this domain or similar ones, they should report it to security teams and avoid entering any personal information. PhishDestroy continues to monitor for related threats.