moonshot-voting-su07cq[.]netlify[.]app

This domain, moonshot-voting-su07cq.netlify.app, is confirmed as a high-risk brand impersonation phishing site targeting Moonshot. Analysis indicates the threat actor designed the page to mimic legitimate voting campaigns under the Moonshot brand, with the page title explicitly stating 'Vote to List — Powered by Moonshot.' No direct crypto drainer kit signatures were observed, but the fraudulent branding and deceptive call-to-action elements align with credential harvesting or social engineering tactics. Infrastructure analysis reveals the domain is hosted on Netlify infrastructure and resolves to the IPv6 address 2a05:d014:58f:6200::258, geolocated in Germany under Amazon.com, Inc. (AS16509). The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1). As of the latest scan, VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious. The domain appears on three independent security blocklists and is actively blocked by at least three major threat intelligence feeds. No Google Safe Browsing (GSB) classification was provided in the available data. The domain remains active despite detection by multiple security mechanisms. Response actions by hosting providers or registrars have not yet resulted in takedown, and the SSL certificate remains valid. The remaining risk is elevated due to the domain's persistence, brand impersonation tactics, and low detection rate relative to vendor coverage. Organizations are advised to block the domain at the DNS or proxy level, monitor for related subdomains, and alert users to the fraudulent Moonshot branding. Continuous monitoring of Netlify-hosted subdomains with similar naming patterns is recommended to preempt further abuse.