moonshot-voting-cbm[.]netlify[.]app

The domain moonshot-voting-cbm.netlify.app was registered on June 24, 2026 and is presently taken offline. Analysis shows the site was hosted on Netlify infrastructure and served a page titled “Vote to List — Powered by Moonshot”. The page returned an HTTP 404 response, indicating the original content is no longer reachable, but the title suggests an attempt to leverage the Moonshot brand for a voting‑related lure. The site resolved to IP address 63.176.8.218, which resolves to a server in Germany operated by Amazon.com, Inc. (AS16509).

The SSL certificate presented by the host is a DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, a legitimate certificate that does not provide assurance of legitimacy when paired with a brand‑impersonating domain. Technical fingerprints include Netlify hosting and enforced HSTS, common for legitimate static‑site deployments but also convenient for malicious actors. Reputation data shows the domain appears on three security blocklists, specifically PhishDestroy, MetaMask, and SEAL, and has a Gridinsoft trust score of 0 out of 100. VirusTotal scans recorded two detections out of 91 security vendors, confirming a subset of scanners flagged the domain for malicious activity.

The evidence collectively points to a brand‑impersonation campaign targeting users of the Moonshot service, likely attempting to harvest credentials or influence voting mechanisms. Uncertainties remain regarding the exact payload delivered, any associated phishing kit, and whether the domain was ever actively serving malicious content before being taken down. Defenders should add the domain to local blocklists, monitor DNS queries for the associated IP range, and consider tightening Netlify‑related outbound rules. Continued surveillance of the IP address and related Netlify subdomains is advised to detect any re‑use of the infrastructure for future impersonation attempts.