moonshot-listing-pmz[.]netlify[.]app

The domain moonshot-listing-pmz.netlify.app is identified as a brand impersonation threat actively targeting the brand Moonshot. The website, which is currently active, uses the page title "Vote to List — Powered by Moonshot" to deceive users into believing it is affiliated with Moonshot, thereby increasing its credibility among potential victims.

Technical analysis of the domain reveals significant indicators of malicious activity. VirusTotal reports that 8 out of 95 security vendors have flagged this domain as suspicious, underscoring its potential threat level. The website is registered through Netlify and resolves to the IP address 2a05:d014:58f:6200::258, hosted in Germany under AS16509, which is associated with Amazon.com, Inc. Moreover, the domain's SSL certificate is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1, which does not inherently indicate malicious activity but is worth noting given the context. The site is listed on three security blocklists, and its brand impersonation tactic has led to it being blocked by PhishDestroy, MetaMask, and SEAL.

Given its active status and high-risk classification, users are advised to exercise caution and avoid interaction with moonshot-listing-pmz.netlify.app. Security teams should ensure this domain is blocked within their networks to prevent potential phishing attacks. Individuals should report any suspicious activity associated with this domain to their respective cybersecurity departments. Regular updates to security software and adherence to security best practices are recommended to mitigate the risks posed by such phishing sites.