moonshot-listing-ljg[.]netlify[.]app

This domain is flagged as a high-risk brand impersonation threat specifically targeting Moonshot, a known cryptocurrency platform. The fraudulent site mimics legitimate token listing services, presenting users with a deceptive voting mechanism to lure victims into interacting with malicious smart contracts or disclosing sensitive wallet credentials. The specific threat type—brand impersonation—exploits trust in the Moonshot brand to facilitate unauthorized transactions or credential theft, a tactic increasingly observed in crypto-related fraud campaigns. Analysis indicates the domain moonshot-listing-ljg.netlify.app is detected by 15 out of 95 security vendors on VirusTotal, signaling a consensus among multiple threat intelligence sources regarding its malicious nature. The domain is hosted on infrastructure belonging to Amazon.com, Inc. (AS16509), resolving to the IP address 63.176.8.218, located in Germany. It is registered through Netlify, a platform commonly abused for rapid deployment of fraudulent sites due to its ease of use and free hosting capabilities. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), does not mitigate the risk, as legitimate certificates are frequently exploited to lend false credibility to malicious domains. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further corroborating its classification as a threat. The page title, 'Moonshot – Vote your token to get listed!', directly impersonates Moonshot’s branding, reinforcing the likelihood of fraudulent intent. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP address (63.176.8.218) at the network perimeter. Organizations and individuals should verify all token listing or voting requests through official Moonshot channels, avoiding interaction with unsolicited links or third-party platforms. Wallet holders are advised to revoke any suspicious smart contract approvals and monitor transaction histories for unauthorized activity. Security teams should update endpoint protection rules to flag domains hosted on Netlify or similar platforms that exhibit brand impersonation patterns, particularly those targeting cryptocurrency services. Additionally, user education should emphasize the risks of engaging with unverified token listing campaigns, as these are frequently leveraged to deploy crypto drainers or credential harvesting scripts.