moonshot-listing-wef[.]netlify[.]app

This domain, moonshot-listing-wef.netlify.app, is flagged as an active brand impersonation threat targeting Moonshot, a recognized entity in the cryptocurrency sector. The page title, 'Vote to List — Powered by Moonshot,' explicitly mimics legitimate promotional or governance-related content, a tactic commonly employed to deceive users into engaging with fraudulent platforms. Analysis indicates this is not a credential theft or generic phishing attempt but a specialized form of brand impersonation aimed at cryptocurrency users, potentially facilitating unauthorized transactions or data harvesting. Infrastructure analysis reveals the domain resolves to the IP address 18.208.88.157, hosted under AS16509 (Amazon.com, Inc.) in Germany. The domain is registered through Netlify, a platform frequently leveraged for rapid deployment of malicious sites due to its ease of use and free tier offerings. As of the latest assessment, the domain is detected by 6 out of 95 security vendors on VirusTotal, with a presence on three distinct security blocklists. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides a veneer of legitimacy, though it does not mitigate the underlying threat. No specific creation date for the subdomain is publicly available, but the active status and recent detections suggest recent deployment. The domain remains operational despite being blocked by multiple security entities. Current response actions include partial containment through blocklists and vendor detections, though the persistence of the threat underscores ongoing risk. Users are advised to exercise extreme caution when encountering this domain, particularly in contexts involving cryptocurrency transactions or governance participation. Verification of official communication channels and direct engagement with the legitimate brand’s platforms are recommended to mitigate exposure. The high-risk classification reflects the domain’s active exploitation of brand trust and its potential to facilitate financial or data compromise.