moonshot-voting-nzf[.]netlify[.]app

This domain, moonshot-voting-nzf.netlify.app, is identified as a high-risk brand impersonation threat targeting Moonshot. Analysis indicates the infrastructure is designed to mimic legitimate Moonshot branding, likely to deceive users into disclosing sensitive information or interacting with fraudulent content. No specific drainer kit signatures have been confirmed at this time, though the domain exhibits characteristics consistent with credential harvesting or social engineering campaigns. Infrastructure analysis reveals the domain resolves to IP address 63.176.8.218 and is hosted through Netlify. VirusTotal detection shows 1 out of 95 security vendors have flagged the domain as malicious. The SSL certificate is issued by DigiCert Inc, providing a veneer of legitimacy. As of the latest assessment, no Google Safe Browsing (GSB) detections or widespread blocklist inclusions have been recorded, though the domain remains under active monitoring. The domain is currently active and continues to pose a risk to users. Response actions include ongoing tracking of associated infrastructure and submission to threat intelligence platforms for further analysis. Despite limited vendor detections, the domain's active status and brand impersonation tactics warrant caution. Organizations and users are advised to block access to this domain and monitor for similar patterns, such as subdomains under Netlify or other content delivery networks, which may indicate additional impersonation attempts.