moonshot-listing-lxh[.]netlify[.]app

This domain, moonshot-listing-lxh.netlify.app, is flagged for brand impersonation targeting Moonshot, a recognized entity in the cryptocurrency or blockchain sector. The site presents itself as a voting platform under the guise of official Moonshot branding, as evidenced by the page title 'Vote to List — Powered by Moonshot.' No direct evidence of a crypto drainer kit or credential harvesting mechanism is observed in initial analysis, though brand impersonation often precedes such attacks. The domain leverages social engineering to deceive users into engaging with fraudulent content, likely aiming to extract sensitive information or manipulate token listings. Analysis indicates the domain resolves to the IPv6 address 2a05:d014:58f:6200::258, hosted on infrastructure associated with AS16509 (Amazon.com, Inc.) in Germany. The domain is registered through Netlify, a legitimate hosting provider often abused for malicious purposes due to its ease of deployment. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, a moderate detection rate that suggests emerging or evasive threats. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating cross-industry recognition of its malicious nature. The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), providing a false sense of legitimacy to unsuspecting users. No Google Safe Browsing (GSB) status is provided, though the domain's active blocklist presence suggests it would likely be flagged. The domain remains active as of the latest verification, posing an ongoing risk to users who may mistake it for an official Moonshot platform. Response actions should include immediate blacklisting of the domain and its associated IP address across enterprise and consumer security tools. Organizations are advised to monitor for user interactions with the domain and conduct retrospective analysis of network logs for connections to 2a05:d014:58f:6200::258. End users should be educated on verifying official domains and scrutinizing page titles, particularly those related to cryptocurrency or token voting platforms. The remaining risk is classified as high due to the domain's active status, brand impersonation tactics, and potential for downstream credential theft or financial fraud.