Known malicious kithighother

BlueMoon - brand-lookalike lure domains (aerospace, defence, industrial) B

family: bluemoon-shadowpad-2026-09

Second half of the look-alike domain set against real aerospace/defence/industrial brands. Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09).

Anchors

SMQL queryrun

domain:*jetoptera.co OR domain:*lindes.ink OR domain:*precipart.ink OR domain:*rocketlabusa.ink OR domain:*silvustechnologies.online OR domain:*smxtech.xyz OR domain:*sncorp.fit OR domain:*spectrolab.fit OR domain:*tcomlp.online OR domain:*worldview.fit

Provenance

Added: 2026-09-12 10:36

Includes jetoptera.co, which is why domain matching is used rather than URL substring matching: a URL substring of jetoptera.co would also match the legitimate jetoptera.com, while the domain suffix match does not.

References:

https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit

Sightings (0)

No sightings recorded yet.