moonshot-voting-ux4[.]netlify[.]app

The domain moonshot-voting-ux4.netlify.app is flagged as a high-risk brand impersonation campaign, currently active and targeting the Moonshot brand. The page impersonates legitimate Moonshot services, specifically a voting mechanism, to deceive users and potentially harvest sensitive information.

Analysis indicates that the domain is flagged by 3 of 95 VirusTotal vendors, suggesting a moderate level of detection among security services. The domain is registered through Netlify and resolves to the IP address 98.84.224.111, which is located in the United States and is part of the Amazon.com, Inc. network (AS14618). The SSL certificate is issued by DigiCert Inc, using the DigiCert Global G2 TLS RSA SHA256 2020 CA1. The domain appears on 3 known security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating that it has been identified as malicious by these platforms.

The domain remains active, and users are advised to exercise extreme caution. Security researchers recommend that organizations and individuals using Moonshot services verify the authenticity of URLs and avoid interacting with unverified domains. Additionally, network administrators should consider blocking the IP address 98.84.224.111 and implementing stricter domain monitoring to prevent potential data breaches or credential theft. Further analysis and monitoring are recommended to track the evolution of this threat and ensure comprehensive protection.