moonshot-listing-gmf[.]netlify[.]app

This domain, moonshot-listing-gmf.netlify.app, is actively engaged in brand impersonation targeting Moonshot, a recognized entity in the cryptocurrency or token listing space. The site presents itself as a legitimate "Vote to List" platform under the guise of being "Powered by Moonshot," a tactic designed to deceive users into participating in fraudulent voting or token listing processes. Such schemes often aim to harvest credentials, personal data, or cryptocurrency deposits under false pretenses, leveraging the trust associated with the impersonated brand to manipulate victims. Analysis indicates the domain is hosted on infrastructure associated with Netlify, a legitimate platform often exploited for phishing due to its ease of deployment and SSL support. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides a veneer of legitimacy but does not mitigate the malicious intent. The domain is flagged by 11 out of 95 security vendors on VirusTotal, and it appears on three independent security blocklists. Additionally, it is blocked by multiple browser-based security tools, further confirming its malicious classification. The domain resolves to IP address 54.253.94.210, located in Germany under AS16509, an autonomous system operated by a major cloud provider. Users who have visited moonshot-listing-gmf.netlify.app or interacted with its content should take immediate remedial action. Disconnect any active sessions, revoke permissions granted to the site in browser or wallet extensions, and scan local systems for malware. If credentials or sensitive information were entered, rotate passwords and monitor associated accounts for unauthorized activity. Cryptocurrency wallets used on the site should be considered compromised; transfer assets to a new wallet and revoke any connected smart contract approvals. Report the domain to relevant security teams or incident response platforms to aid in broader mitigation efforts.