moonshots-pro[.]fun

Analysis shows that moonshots-pro.fun was registered on April 12, 2026 and currently resolves to the Cloudflare address 104.21.83.102, a location associated with CA. The domain is hosted behind Cloudflare’s infrastructure, using the nameservers titan.ns.cloudflare.com and nova.ns.cloudflare.com. It carries a Let’s Encrypt certificate issued under the E7 identifier, which does not provide any indication of legitimacy and is commonly employed by malicious operators to obtain free HTTPS.

The site returns HTTP status code 403, and the only visible page title is "Just a moment...". No additional page content has been captured, so the nature of the landing page remains uncertain. Threat intelligence records list the domain in one blocklist and flag it in a single AlienVault OTX pulse. VirusTotal scanning shows that 2 out of 95 security vendors have flagged the domain, while the Gridinsoft trust score is 0 out of 100, indicating a high likelihood of malicious intent. The domain is categorized as a brand impersonation targeting the brand Moonshot, and it is explicitly listed as an impersonation scam.

While the available data points to a high‑risk profile, the exact payload or credential‑harvesting mechanisms have not been observed, leaving the specifics of the impersonation tactics unknown. Defenders should assume the domain is intended to lure victims by abusing the Moonshot brand, despite the lack of visible phishing forms at the moment of analysis.

Recommended mitigations include adding moonshots‑pro.fun to URL filtering and DNS block lists across network perimeters, monitoring for any DNS queries to the associated IP address, and updating endpoint detection signatures to flag the domain’s low trust score. Continuous observation of threat intel feeds for further indicators, such as new OTX pulses or additional vendor detections, will help refine response actions as more evidence emerges.