moonshot-listing-elg[.]vercel[.]app

This domain, moonshot-listing-elg.vercel.app, is identified as a high-risk brand impersonation threat targeting Moonshot, a cryptocurrency project. The page title, 'Vote to List — Powered by Moonshot,' suggests an attempt to deceive users into believing they are participating in an official voting or listing process. No specific drainer kit signature has been confirmed, but the domain exhibits characteristics consistent with crypto-focused phishing campaigns, including the use of social engineering to manipulate victims into disclosing sensitive credentials or wallet information.

Infrastructure analysis reveals the following technical indicators: the domain is flagged by 11 out of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence feeds. It is registered through Vercel Inc., a platform commonly exploited for rapid deployment of phishing pages due to its ease of use and free hosting capabilities. The domain resolves to the IP address 64.29.17.195, located within Amazon.com, Inc.'s AS16509 network in the United States. The SSL certificate is issued by Google Trust Services (WR1), a legitimate provider, which may lend a false sense of security to potential victims. The domain appears on three independent security blocklists and is actively blocked by multiple browser-based and wallet security extensions. No creation date is publicly available, and Google Safe Browsing (GSB) status remains unconfirmed at this time.

As of the latest verification, the domain remains active and continues to host the fraudulent 'Vote to List' page. Response actions by security providers, including inclusion on blocklists and browser-based protections, have mitigated but not eliminated the threat. Users are advised to treat any interaction with this domain as malicious and avoid entering credentials, connecting wallets, or downloading files. Organizations targeting cryptocurrency communities should update internal blocklists to include this domain and its associated IP address. The remaining risk is classified as high due to the domain's active status, broad detection evasion, and direct targeting of a cryptocurrency brand with a plausible pretext.