moonshot-listing-xtp[.]vercel[.]app

This domain, moonshot-listing-xtp.vercel.app, is flagged as an active brand impersonation threat targeting the cryptocurrency platform Moonshot. The page title, 'Vote to List — Powered by Moonshot,' explicitly mimics legitimate Moonshot branding to deceive users into engaging with fraudulent content. Analysis indicates no direct evidence of a crypto drainer kit, but the domain’s structure and branding suggest intent to harvest credentials or manipulate users into unauthorized transactions under false pretenses.

Infrastructure analysis reveals the following technical indicators: the domain is registered through Vercel Inc. and resolves to IP address 64.29.17.67, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. VirusTotal detection metrics show 12 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence platforms. SSL certification is provided by Google Trust Services (WR1), which, while not inherently malicious, is commonly exploited by threat actors to lend false legitimacy to phishing sites. No creation date is available, but the domain remains operational and unlisted on Google Safe Browsing (GSB) at the time of assessment.

Current status indicates the domain remains active, posing a high-risk threat to users. Response actions by security platforms, including MetaMask and SEAL, have mitigated exposure, but the domain’s persistence suggests ongoing malicious activity. Remaining risk includes potential credential theft, unauthorized fund transfers, or further propagation of fraudulent schemes. Users are advised to avoid interaction with the domain, verify all communications through official Moonshot channels, and report the domain to relevant security teams for takedown. Organizations should update blocklists and monitor for similar impersonation attempts leveraging Vercel or other hosting providers.