Known malicious kithighother

BlueMoon - brand-lookalike lure domains (aerospace, defence, industrial) A

family: bluemoon-shadowpad-2026-09

Lookalike domains registered by the actor against real aerospace/defence/industrial brands on cheap TLDs (.fit .ink .lol .online .site). Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09) and MISP event 22904. SMQL hunts are DETECTORS, not verdict rules: match_tier 'smql' is excluded from both engines' verdict paths by design, so this collects sightings and shows a banner. Flooring for these indicators comes from the MISP feed via ioc-matcher.

Anchors

SMQL queryrun

domain:*airindia.fit OR domain:*airliquide.lol OR domain:*airproducts.ink OR domain:*apollohospitals.fit OR domain:*aurexdefense.online OR domain:*bosch-sensortec.site OR domain:*cyclokinetics.online OR domain:*emcore.ink OR domain:*epsilonsystems.net OR domain:*haloengines.net

Provenance

Added: 2026-09-12 10:36

Each is a real company's brand on a TLD that company does not use. Suffix matching keeps them off the genuine .com domains. 10 nodes. 0 matches at creation.

References:

https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit

Sightings (0)

No sightings recorded yet.