moonshot-listing-kof[.]vercel[.]app

This domain, moonshot-listing-kof.vercel.app, poses a high-risk brand impersonation threat specifically targeting Moonshot, a cryptocurrency platform. The page title, 'Vote to List — Powered by Moonshot,' is designed to deceive users into believing they are interacting with an official Moonshot voting or listing portal. Such impersonation schemes typically aim to harvest credentials, distribute malware, or facilitate cryptocurrency theft by exploiting trust in the targeted brand. The domain mimics legitimate Moonshot infrastructure, increasing the likelihood of successful social engineering attacks against users familiar with the brand’s services or community initiatives.

Analysis of the domain reveals multiple technical indicators confirming its malicious nature. The domain resolves to IP address 64.29.17.67, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. It is registered through Vercel Inc. and remains active despite being flagged by 11 out of 95 security vendors on VirusTotal. Additionally, the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the risk, as threat actors frequently use valid certificates to lend credibility to malicious sites. The unique seed identifier for this threat is 278881, distinguishing it from other impersonation campaigns.

Users who have visited moonshot-listing-kof.vercel.app should take immediate action to mitigate potential compromise. Disconnect any active sessions with the domain and revoke permissions granted to it in browser-based cryptocurrency wallets or extensions. Scan the affected device using updated security tools to detect and remove any malware or unauthorized scripts. Change passwords and credentials for any accounts accessed while the domain was open, particularly those associated with cryptocurrency platforms or financial services. Monitor accounts for unauthorized transactions and report the domain to relevant security teams or threat intelligence platforms to aid in broader mitigation efforts.