moonshot-voting-hcz8ch[.]netlify[.]app

moonshot-voting-hcz8ch.netlify.app is currently active and impersonates the brand Moonshot. It has been flagged by three public blocklists, including PhishDestroy, MetaMask, and SEAL. Despite having zero detections on VirusTotal, this domain is identified early in its lifecycle, taking advantage of the typical 24-72 hour gap before antivirus databases update. PhishDestroy's proactive detection pipeline captures such threats during this critical window.

The domain is registered through Netlify and hosted on an Amazon server in Germany, with an IP address of 63.176.8.218. The SSL certificate is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1. This setup suggests a well-resourced operation, potentially aiming to exploit users' trust in Moonshot's brand.

The domain's abuse score is 19 out of 100, indicating some level of suspicious activity. The combination of early detection and inclusion in multiple blocklists underscores the potential threat it poses to users. As phishing domains often target users with convincing imitations, moonshot-voting-hcz8ch.netlify.app is a clear example of how cybercriminals can quickly deploy and exploit such sites before they appear on antivirus radars.