moonshot-listing-ajx[.]netlify[.]app

This domain operates as a confirmed brand impersonation site targeting Moonshot, a cryptocurrency project. The page presents itself as a legitimate token listing platform under the title 'Vote to List — Powered by Moonshot,' designed to deceive users into participating in fraudulent voting or token submission processes. The threat specifically exploits trust in Moonshot’s branding to harvest credentials, private keys, or direct cryptocurrency transfers under the guise of a community-driven listing mechanism. The deceptive interface mimics official project communications, increasing the likelihood of successful social engineering attacks against token holders and investors. Analysis of the domain reveals multiple technical indicators confirming malicious intent. The domain is flagged by 15 out of 95 security vendors on VirusTotal, with detections from major threat intelligence platforms. It appears on three independent security blocklists, including those specializing in cryptocurrency fraud prevention. Infrastructure analysis reveals the domain is hosted on Netlify, a legitimate cloud platform often abused for phishing due to its free hosting and SSL capabilities. The site resolves to IP address 54.253.94.210, located in Germany under Amazon.com, Inc.’s autonomous system (AS16509). The SSL certificate, issued by DigiCert Inc, provides a false sense of security while failing to validate the site’s legitimacy. Users who have visited moonshot-listing-ajx.netlify.app should immediately revoke any permissions granted to the site via wallet connections or browser extensions. All credentials, private keys, or recovery phrases entered on the site should be considered compromised. Affected users must transfer assets to new, secure wallets and monitor accounts for unauthorized transactions. No interaction with the domain should occur, including clicking links or downloading files. If financial loss occurred, report the incident to relevant financial authorities and cryptocurrency abuse tracking platforms. Organizations should update internal blocklists to include this domain and its associated IP address to prevent further exposure.