moonshot-voting-to82r8[.]netlify[.]app

The domain moonshot-voting-to82r8.netlify.app was created on June 24, 2026 and is currently offline, returning an HTTP 404 status. The site resolves to the IPv6 address 2600:1f18:16e:df01::258, which is owned by Amazon.com, Inc. (AS16509) and geolocated to Germany. Hosting and technology footprints indicate the site was deployed on Netlify and enforces HTTP Strict Transport Security (HSTS). The TLS certificate presented is a DigiCert Global G2 RSA SHA256 2020 CA1 issued by DigiCert Inc., confirming a valid, publicly trusted certificate chain.

Brand analysis shows the page title "Vote to List — Powered by Moonshot" and the listed impersonated brand "Moonshot," classifying the activity as a brand impersonation campaign. No additional page content has been captured, so the exact visual or functional mimicry cannot be confirmed. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating an extremely low confidence in legitimacy. VirusTotal reports 11 of 91 scanned security vendors flagging the domain, reinforcing the malicious assessment. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple defensive platforms have identified it as a threat.

Uncertainties remain around the specific payload or credential collection mechanisms, as the site returned a 404 and no further content has been archived. The absence of public nameserver records (NS_NOT_FOUND) limits deeper DNS analysis. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor for any related subdomains or Netlify‑hosted assets, and update detection rules to include the observed IPv6 address and SSL fingerprint. Incident response teams should also review any recent Moonshot‑related user reports for potential phishing attempts that may have leveraged this infrastructure before it was taken offline.