moonshot-voting-c0lkr6[.]netlify[.]app

Analysis of the domain moonshot-voting-c0lkr6.netlify.app indicates a high-risk brand impersonation campaign targeting Moonshot. The domain, registered on June 23, 2026, through Netlify, resolves to IP address 98.84.224.111, hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. As of July 24, 2026, the domain is offline, returning an HTTP 404 status, though it previously displayed the page title 'Vote to List — Powered by Moonshot,' which aligns with the identified scam type of brand impersonation. Security vendor detections on VirusTotal show 12 of 91 engines flagging the domain as malicious, while it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL.

Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), a common certificate authority for both legitimate and malicious domains, providing no conclusive indication of intent. Infrastructure analysis reveals the use of Netlify hosting and HSTS implementation, though no nameservers were detected (NS_NOT_FOUND). The absence of nameservers may suggest takedown efforts or incomplete domain configuration.

While the exact content of the phishing page remains unanalyzed, the page title and scam type indicate an attempt to impersonate Moonshot, likely for credential harvesting or fraudulent voting schemes. Defenders should treat this domain as confirmed malicious. Block access at the network level, update endpoint protection rules, and monitor for related indicators of compromise, including the IP 98.84.224.111 and associated SSL certificate thumbprint. Given its current offline status, further activity may emerge under new subdomains or related infrastructure.