moonshot-listing-zgx[.]netlify[.]app

The domain moonshot-listing-zgx.netlify.app has been identified as a high-risk infrastructure used for brand impersonation, specifically targeting the brand Moonshot. The site appears to mimic legitimate Moonshot pages, likely to deceive users into performing actions such as voting or providing personal information, which could be leveraged for malicious purposes.

Analysis indicates that the domain has been flagged by 4 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection. The domain is registered through Netlify and resolves to the IP address 98.84.224.111, which is located in Germany and is part of the AS16509 network operated by Amazon.com, Inc. The SSL certificate used is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1. The domain appears on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL, further corroborating its malicious nature. The creation date of the domain is not specified, but it is currently active as of the latest investigation.

The current status of moonshot-listing-zgx.netlify.app is active, indicating that it continues to pose a threat to unsuspecting users. Response actions should include immediate blocking of the domain by security solutions and network administrators to prevent access. Users should be educated to verify the URL and SSL certificate of any Moonshot-related pages they visit. Despite the blocklisting, the domain remains accessible to a significant portion of users, and the risk of data compromise or financial loss remains high. Ongoing monitoring and proactive measures are essential to mitigate this threat.