moonshot-listing-9nz[.]vercel[.]app

This domain, moonshot-listing-9nz.vercel.app, operates as a high-risk brand impersonation scheme targeting users of the Moonshot platform. Analysis indicates the site presents a fraudulent "Vote to List" interface, falsely claiming affiliation with Moonshot to deceive visitors into engaging with malicious content. The page title, "Vote to List — Powered by Moonshot," directly mimics legitimate branding, increasing the likelihood of user compromise through social engineering tactics. Given the domain's active status and targeted nature, it poses a significant risk for credential harvesting or cryptocurrency-related fraud, particularly within the decentralized finance ecosystem.

Evidence supporting the malicious classification includes detection by 10 out of 95 security vendors on VirusTotal, with three independent security blocklists listing the domain as harmful. Infrastructure analysis reveals the domain is registered through Vercel Inc. and resolves to the IP address 216.198.79.67, hosted on Amazon Web Services (AS16509). The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the threat, as the domain remains actively serving phishing content. The combination of brand impersonation, active blocklist presence, and low vendor detection disparity underscores the domain's calculated design to evade initial scrutiny while maximizing victim reach.

Users who have visited moonshot-listing-9nz.vercel.app should immediately revoke any permissions granted to connected applications or wallets, particularly those associated with cryptocurrency transactions. All credentials entered on the site must be considered compromised and should be changed across any platforms where identical or similar passwords were used. Network-level blocking of the domain and its resolving IP (216.198.79.67) is recommended to prevent further exposure. Organizations should update internal blocklists and monitor for indicators of compromise, including unexpected wallet transactions or unauthorized access attempts originating from user accounts that interacted with the domain.