moonshot-voting-y31[.]netlify[.]app

This domain is flagged as a high-risk brand impersonation threat targeting Moonshot. The page, titled 'Vote to List — Powered by Moonshot,' mimics legitimate Moonshot branding to deceive users into interacting with fraudulent voting or listing mechanisms, likely to harvest credentials or distribute malicious payloads.

Analysis indicates the domain is still active and hosted on Netlify infrastructure, resolving to IP address 54.253.94.210 (Amazon.com, Inc., AS16509, AU). It uses an SSL certificate issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1). The domain appears on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. Despite its malicious nature, VirusTotal reports 0/95 detections, suggesting it remains undetected by many security engines. No creation date is provided, but the domain's active status and blocklist presence confirm its ongoing threat.

Mitigation requires immediate blocking of the domain and its resolving IP (54.253.94.210) at network and endpoint levels. Organizations should update security policies to flag Netlify-hosted subdomains with 'moonshot' branding as potential impersonation attempts. Users should be alerted to verify Moonshot-related communications via official channels only, avoiding interaction with unsolicited voting or listing prompts. SSL inspection tools should monitor for DigiCert-issued certificates associated with this infrastructure to prevent further exploitation.