moonshot-listing-0hq[.]vercel[.]app

This domain, moonshot-listing-0hq.vercel.app, poses a high-risk brand impersonation threat targeting Moonshot, a recognized entity in the cryptocurrency or digital asset sector. The phishing page displays the title 'Vote to List — Powered by Moonshot,' mimicking legitimate promotional or community engagement campaigns. Such impersonation tactics are designed to deceive users into disclosing sensitive credentials, transferring digital assets, or interacting with malicious smart contracts under the false pretense of official endorsement. The fraudulent nature of this domain is further evidenced by its active use in campaigns aimed at exploiting trust in the Moonshot brand, potentially leading to financial loss or unauthorized access to user accounts. Analysis indicates that moonshot-listing-0hq.vercel.app is flagged by 9 out of 95 security vendors on VirusTotal, a significant detection ratio that underscores its malicious classification. The domain is registered through Vercel Inc., a platform commonly exploited for rapid deployment of phishing infrastructure due to its ease of use and free hosting capabilities. Infrastructure analysis reveals the domain resolves to the IP address 216.198.79.67, located within the United States under AS16509 (Amazon.com, Inc.). The SSL certificate is issued by Google Trust Services (WR1), which, while providing encryption, does not validate the legitimacy of the content served. Additionally, the domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, further confirming its malicious status. Users who have interacted with moonshot-listing-0hq.vercel.app are advised to take immediate remedial actions to mitigate potential risks. Any credentials, wallet addresses, or personal information entered on the site should be considered compromised and must be changed or revoked without delay. Affected individuals should review their digital asset wallets for unauthorized transactions and enable multi-factor authentication on all critical accounts. It is also recommended to monitor for signs of identity theft or follow-on phishing attempts via email or messaging platforms. If the domain was accessed through a corporate or institutional network, internal security teams should be notified to conduct a broader investigation and implement necessary containment measures.