moonshot-voting-npiejn[.]netlify[.]app

This domain, moonshot-voting-npiejn.netlify.app, is currently active and classified as a brand impersonation threat targeting Moonshot. The site presents itself as a legitimate voting platform under the guise of "Vote to List — Powered by Moonshot," attempting to deceive users into engaging with fraudulent content. Analysis indicates this is a high-risk operation designed to exploit trust in the Moonshot brand for malicious purposes. Infrastructure analysis reveals the domain is flagged by 4 of 95 security vendors on VirusTotal, with detections from multiple threat intelligence sources. It appears on three security blocklists and is actively blocked by at least three major security providers. The domain is hosted on Netlify and resolves to the IP address 63.176.8.218, located in Germany under AS16509 (Amazon.com, Inc.). The SSL certificate is issued by DigiCert Inc, specifically a DigiCert Global G2 TLS RSA SHA256 2020 CA1, which, while valid, does not mitigate the domain's malicious intent. No legitimate creation date or registration details were provided, further indicating its suspicious nature. Current status confirms the domain remains active, posing an ongoing threat to users. Organizations and individuals are advised to block access to this domain immediately and report it to their security teams. Users should verify the authenticity of any voting or promotional pages claiming affiliation with Moonshot by cross-referencing official communications. Security teams are encouraged to monitor for additional indicators of compromise, including the IP address 63.176.8.218 and associated domains hosted on the same infrastructure. Proactive measures, such as updating blocklists and educating users on recognizing brand impersonation tactics, are recommended to mitigate risk.