moonshot-voting-6n3fro[.]netlify[.]app

This domain is flagged as a high-risk brand_impersonation threat, specifically targeting Moonshot through a fraudulent voting portal infrastructure. Analysis indicates the domain is designed to deceive users into believing they are interacting with an official Moonshot platform, likely for credential harvesting or unauthorized data collection purposes. Infrastructure analysis reveals the domain is registered through Netlify and resolves to IP address 35.157.26.135, hosted on Amazon.com, Inc. (AS16509) in Germany. Security vendor detections show 9 out of 95 engines on VirusTotal have flagged the domain as malicious. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence platforms. The SSL certificate is issued by DigiCert Inc, using the DigiCert Global G2 TLS RSA SHA256 2020 CA1 intermediate, which does not mitigate the underlying fraudulent nature of the domain. Current status confirms the domain remains active and operational. Mitigation steps specific to this brand_impersonation threat include immediate blacklisting of the domain and associated IP address across all network security controls. Organizations should implement strict domain validation policies to detect similar impersonation patterns, such as subdomain spoofing or lookalike character usage. User awareness training should emphasize verification of official communication channels and reporting of suspicious domains. Network monitoring should prioritize detection of connections to this infrastructure, particularly from systems handling sensitive operations or credentials. Domain registrars and hosting providers should be notified to facilitate takedown procedures under relevant abuse policies.