Known malicious kithighother

BlueMoon - brand-lookalike lure domains (aerospace, defence, industrial) B

family: bluemoon-shadowpad-2026-09

Second half of the lookalike set; split only to stay under the SMQL 20-node cap. Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09) and MISP event 22904. SMQL hunts are DETECTORS, not verdict rules: match_tier 'smql' is excluded from both engines' verdict paths by design, so this collects sightings and shows a banner. Flooring for these indicators comes from the MISP feed via ioc-matcher.

Anchors

SMQL queryrun

domain:*jetoptera.co OR domain:*lindes.ink OR domain:*precipart.ink OR domain:*rocketlabusa.ink OR domain:*silvustechnologies.online OR domain:*smxtech.xyz OR domain:*sncorp.fit OR domain:*spectrolab.fit OR domain:*tcomlp.online OR domain:*worldview.fit

Provenance

Added: 2026-09-12 10:36

Includes jetoptera.co, which is why url: substring matching was rejected for this family: url:jetoptera.co would also match the legitimate jetoptera.com. domain:* is suffix-anchored and does not. 10 nodes. 0 matches at creation.

References:

https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit

Sightings (0)

No sightings recorded yet.