moonshot-listing-imh[.]vercel[.]app

The domain moonshot-listing-imh.vercel.app is currently active and flagged as a brand impersonation threat targeting Moonshot. Analysis indicates the site mimics legitimate Moonshot branding, presenting itself as a voting platform under the title "Vote to List — Powered by Moonshot." This infrastructure is designed to deceive users into engaging with fraudulent content, likely for credential harvesting or financial fraud. Infrastructure analysis reveals the domain is registered through Vercel Inc. and resolves to the IP address 216.198.79.67, hosted on Amazon.com, Inc. (AS16509) in the United States. The SSL certificate is issued by Google Trust Services (WR1). The domain appears on three security blocklists and is flagged by 10 of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence platforms. The page title and branding elements closely resemble official Moonshot communications, increasing the likelihood of successful social engineering attacks. Current status confirms the domain remains active, posing a high risk to users and organizations associated with Moonshot. Immediate mitigation steps include blocking the domain and IP at the network perimeter, updating endpoint protection rules, and alerting users to the impersonation threat. Organizations should monitor for similar domains leveraging the Vercel.app namespace, as this hosting provider is frequently abused for phishing campaigns. Incident response teams are advised to review logs for connections to 216.198.79.67 and correlate with any suspicious user activity.