moonshot-voting-xpu[.]netlify[.]app

This domain, moonshot-voting-xpu.netlify.app, is flagged as a brand impersonation threat targeting Moonshot, a recognized entity in the cryptocurrency or project governance space. The page title, "Vote to List — Powered by Moonshot," explicitly mimics Moonshot’s branding to deceive users into participating in a fraudulent voting or listing process. Analysis indicates this is not a generic phishing attempt but a targeted impersonation designed to exploit trust in the Moonshot name, potentially for malicious activities such as credential harvesting or token theft.

Technical indicators reveal the domain is hosted on Netlify’s platform and resolves to the IP address 35.157.26.135. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, suggesting the infrastructure has not yet been widely flagged. No creation date is publicly available through standard WHOIS queries due to Netlify’s hosting model, which obscures domain registration details. Google Safe Browsing (GSB) status remains unconfirmed, and no blocklist entries have been recorded at the time of this investigation. The absence of detections does not indicate safety, as brand impersonation domains often evade initial scans by leveraging legitimate hosting providers.

The domain remains active, and no takedown actions have been observed. Users are advised to treat any interaction with this domain as high-risk, particularly if prompted to connect wallets, submit credentials, or participate in voting processes. Organizations associated with Moonshot should monitor for similar impersonation attempts and consider preemptive measures such as domain squatting protections or public warnings. The lack of detections underscores the need for proactive threat hunting, as this infrastructure may serve as a precursor to broader campaigns.