moonshot-listing-dry[.]vercel[.]app

Analysis of moonshot-listing-dry.vercel.app shows a high‑risk brand‑impersonation operation targeting the Moonshot brand. The domain was created on June 18, 2026 and is hosted on the Vercel platform, as indicated by the detected Vercel technology stack and the presence of HSTS. DNS resolution points to IP address 64.29.17.67, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site served an HTTP 451 status code before being taken offline, and the SSL certificate presented was issued by Google Trust Services under the WR1 certificate authority, confirming that TLS was in place at the time of observation. The page title returned by the server, "Vote to List — Powered by Moonshot," directly references the Moonshot brand, matching the listed brand target and confirming the impersonation intent.

Reputation signals are strongly negative: the domain received a Gridinsoft trust score of 0 out of 100, appears on three external blocklists, and has been listed by PhishDestroy, MetaMask, and SEAL as malicious. VirusTotal analysis flagged the domain in 11 of 91 security vendor scans, reinforcing the suspicion of malicious activity. Nameserver information is unavailable (NS_NOT_FOUND), limiting deeper DNS‑level attribution, and the site is currently offline, preventing real‑time content inspection.

Defenders should immediately block the domain and the associated IP address at network perimeters and endpoint protection layers. Adding the domain to internal URL filtering lists and sharing the indicator with threat‑intel sharing platforms will help accelerate community response. Continuous monitoring of the IP range owned by AS16509 is advised, as the infrastructure could be repurposed for further impersonation campaigns. Since the site is offline, future activity should be tracked through passive DNS and certificate transparency logs to detect any re‑registration attempts or related sub‑domains that might reuse the same hosting configuration.