moonshot-voting-5x6[.]netlify[.]app

This domain, moonshot-voting-5x6.netlify.app, is flagged as a high-risk brand impersonation threat targeting Moonshot, a known cryptocurrency platform. Analysis indicates the site mimics legitimate token voting campaigns, likely to deceive users into interacting with malicious smart contracts or disclosing sensitive wallet credentials. The page title, 'Moonshot – Vote your token to get listed!', directly references Moonshot’s branding, reinforcing the impersonation angle. No explicit crypto drainer kit signatures were detected, but the domain’s structure and messaging align with typical token-voting scams observed in recent threat campaigns. Infrastructure analysis reveals the domain is hosted on Netlify’s platform, utilizing a DigiCert Inc SSL certificate for encryption. It resolves to the IP address 63.176.8.218, and VirusTotal reports only 1 of 95 security vendors flagging the domain as malicious. The domain’s registration details are obfuscated through Netlify’s hosting service, with no public creation date available. Google Safe Browsing (GSB) status is currently unlisted, and no additional blocklist entries were identified beyond the single VirusTotal detection. The low detection rate suggests either a newly deployed threat or effective evasion techniques. As of the latest assessment, the domain remains active and unblocked by most security vendors. Users are advised to avoid interacting with the site, particularly those holding Moonshot tokens or engaging in cryptocurrency voting platforms. Organizations should monitor for similar Netlify-hosted subdomains mimicking legitimate brands, as this infrastructure is frequently abused for short-lived phishing campaigns. Immediate mitigation includes adding the domain to enterprise blocklists and alerting users to the impersonation risk. Despite the low detection rate, the domain’s active status and targeted branding pose a credible threat to unsuspecting victims.