moonshot-listing-gbq[.]vercel[.]app

This domain, moonshot-listing-gbq.vercel.app, is identified as a high-risk brand impersonation threat specifically targeting Moonshot. The page title, 'Vote to List — Powered by Moonshot,' explicitly mimics the legitimate brand to deceive users into engaging with fraudulent content. Analysis indicates this is not a generic phishing attempt but a targeted campaign leveraging Moonshot’s branding to exploit trust and potentially facilitate cryptocurrency-related fraud, such as token listing scams or wallet drainer schemes. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 10 out of 95 security vendors on VirusTotal, a significant detection rate for a recently deployed resource. It is registered through Vercel Inc. and resolves to the IP address 216.198.79.67, hosted on Amazon.com, Inc.’s AS16509 network in the United States. The SSL certificate is issued by Google Trust Services (WR1), which, while legitimate, does not mitigate the domain’s malicious intent. The domain appears on three security blocklists, including PhishDestroy and MetaMask, further corroborating its fraudulent nature. No legitimate creation date or historical context is provided, suggesting a short-lived, disposable infrastructure typical of phishing campaigns. As of the latest assessment, moonshot-listing-gbq.vercel.app remains active and unmitigated, posing an ongoing risk to users. The domain’s presence on multiple blocklists and its high detection rate on VirusTotal indicate a well-documented threat, yet no takedown or suspension has been observed. Users are advised to treat this domain as malicious and avoid interaction entirely. Organizations targeted by this impersonation should monitor for similar domains registered through Vercel or other cloud providers, as these platforms are frequently abused for rapid deployment of fraudulent infrastructure. Immediate reporting to security teams and domain registrars is recommended to expedite mitigation.