moonshot-listing-ses[.]netlify[.]app

This domain, moonshot-listing-ses.netlify.app, is actively engaged in brand impersonation targeting Moonshot, a recognized entity in the cryptocurrency sector. The page title, "Vote to List — Powered by Moonshot," explicitly mimics official Moonshot branding, suggesting an attempt to deceive users into believing the site is legitimate. As of the latest assessment, the domain remains active and continues to pose a high-risk threat to users. Analysis indicates the domain is flagged by 10 of 95 security vendors on VirusTotal, reflecting a moderate but concerning level of detection. It appears on three distinct security blocklists, further corroborating its malicious classification. The domain is registered through Netlify and resolves to the IP address 18.208.88.157, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in Germany. The SSL certificate is issued by DigiCert Inc, specifically under the "DigiCert Global G2 TLS RSA SHA256 2020 CA1" chain, which does not mitigate the domain's malicious intent. No legitimate creation date or historical context is available to suggest benign origins. The domain remains operational and unmitigated, requiring immediate action from security teams. Organizations are advised to block the domain at the network level and update endpoint protection rules to prevent access. Users should be alerted to the impersonation attempt, particularly those interacting with Moonshot-related services. Monitoring for similar domains registered through Netlify or resolving to the same IP range is recommended to preempt further abuse. Incident responders should treat any interaction with this domain as a potential compromise and investigate accordingly.