moonshot-voting-8lup4e[.]netlify[.]app

This domain, moonshot-voting-8lup4e.netlify.app, is currently active and engaged in brand impersonation targeting Moonshot, a recognized entity in the cryptocurrency sector. The threat type is specifically classified as brand impersonation, designed to deceive users into believing they are interacting with legitimate Moonshot services or communications. As of the latest assessment, the domain remains operational and poses a high risk to unsuspecting users. Analysis indicates that the domain is flagged by 7 of 95 security vendors on VirusTotal, a notable indicator of its malicious nature. The domain is registered through Netlify and resolves to the IP address 63.176.8.218, located in Germany under Amazon.com, Inc.'s autonomous system (AS16509). The SSL certificate is issued by DigiCert Inc, specifically under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain. The domain appears on three security blocklists, further corroborating its association with malicious activities. Infrastructure analysis reveals that the domain leverages cloud-based hosting, a common tactic to evade detection and maintain operational resilience. The current status of moonshot-voting-8lup4e.netlify.app remains active, with no indications of takedown or mitigation efforts. Users and organizations are advised to implement immediate countermeasures, including blocking the domain at the network level and updating endpoint protection rules to prevent access. Security teams should monitor for any interactions with this domain within their environments and conduct retrospective analysis to identify potential compromise. Given the high-risk nature of this threat, heightened vigilance and proactive defense measures are strongly recommended to mitigate the risk of brand impersonation and associated fraudulent activities.