moonshot-listing-hps[.]netlify[.]app

This domain, moonshot-listing-hps.netlify.app, is flagged for brand impersonation targeting Moonshot, a cryptocurrency platform. The threat type involves a fraudulent voting page titled 'Vote to List — Powered by Moonshot,' designed to deceive users into engaging with malicious content under the guise of a legitimate brand. No specific drainer kit has been identified, but the page structure suggests an intent to harvest user interactions or credentials through social engineering tactics. Analysis indicates the domain resolves to IP address 63.176.8.218, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in Germany. The SSL certificate is issued by DigiCert Inc under the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' chain. VirusTotal reports 11 out of 95 security vendors flagging the domain as malicious. The domain is registered through Netlify and currently appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. No Google Safe Browsing (GSB) status is provided, but the active blocklist presence confirms its detection by multiple threat intelligence sources. The domain remains active as of the latest assessment, posing a high risk to users who may mistake it for a legitimate Moonshot service. Response actions include blocking the domain at the DNS or network level, particularly for entities handling cryptocurrency transactions. Remaining risk includes potential credential theft or unauthorized access to user accounts if victims interact with the fraudulent page. Organizations are advised to update their threat intelligence feeds to include this domain and monitor for related indicators of compromise, such as the associated IP address and SSL certificate details.