moonshot-voting-ddt[.]netlify[.]app

This domain, moonshot-voting-ddt.netlify.app, is flagged as an active phishing site specializing in brand impersonation targeting Moonshot. The threat type is classified as credential harvesting, with the intent to deceive users into submitting sensitive login information under the guise of a legitimate Moonshot service. The domain remains operational as of the latest analysis, posing a high risk to unsuspecting users. Analysis indicates that the domain is registered through Netlify, a platform commonly used for hosting static websites. It resolves to the IP address 35.157.26.135, which has been associated with suspicious activity in prior campaigns. The domain has been flagged by 1 of 95 security vendors on VirusTotal, a notably low detection rate that may indicate evasion techniques or recent deployment. The SSL certificate is issued by DigiCert Inc, providing a veneer of legitimacy to the malicious site. No additional historical data, such as domain creation date or blocklist counts, is available at this time, limiting further contextual assessment. The current status of moonshot-voting-ddt.netlify.app is active, with no indications of takedown or mitigation efforts. Organizations and users are advised to block access to the domain and its associated IP address, 35.157.26.135, at the network perimeter. Security teams should monitor for any attempts to access this domain within their environments and investigate potential credential exposure. End-users should be educated on recognizing brand impersonation tactics, particularly those involving login portals or voting-related lures. If credentials have been submitted to this domain, immediate password resets and multi-factor authentication enforcement are recommended for all affected accounts.