moonshot-listing-y6n[.]vercel[.]app

This domain, moonshot-listing-y6n.vercel.app, poses a high-risk brand impersonation threat targeting users of the Moonshot platform. The site mimics the legitimate Moonshot interface, presenting a page titled 'Moonshot – Vote your token to get listed!' to deceive visitors into submitting sensitive information, such as token credentials or wallet details. The fraudulent page is designed to exploit trust in the Moonshot brand, likely aiming to harvest login data or cryptocurrency wallet access for malicious purposes. Given the domain's active status and targeted impersonation, users are at significant risk of financial loss or unauthorized account access if they interact with the site. Analysis indicates the domain is flagged by 4 out of 95 security vendors on VirusTotal, a relatively low detection rate that may reflect its recent creation or evasion techniques. The domain is registered through Vercel Inc. and resolves to the IP address 64.29.17.67, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. The SSL certificate is issued by Google Trust Services (WR1), which, while legitimate, does not mitigate the malicious intent of the domain. Additionally, the domain appears on three security blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL, further confirming its malicious classification. If a user has visited moonshot-listing-y6n.vercel.app or interacted with its content, immediate action is required to mitigate potential risks. First, disconnect any active sessions or wallet connections associated with the site. Users should revoke permissions for any suspicious smart contracts or applications linked to their accounts. Next, scan the device for malware using updated security tools, as phishing sites may deploy additional payloads. Monitor accounts for unauthorized transactions or changes, and enable multi-factor authentication where available. If credentials or wallet details were entered, consider migrating assets to a new wallet and reporting the incident to the legitimate Moonshot platform for further guidance. Avoid reusing passwords or sharing sensitive information with unverified sources in the future.