moonshot-listing-9nu[.]netlify[.]app

The domain moonshot-listing-9nu.netlify.app is currently active and hosts a generic phishing campaign. Infrastructure analysis shows the domain resolves to the IP address 35.157.26.135 and is served from Netlify’s hosting platform. DNS resolution attempts return no authoritative nameserver information (NS_NOT_FOUND), indicating that the attacker may be relying on Netlify’s default DNS configuration.

VirusTotal has recorded detections from six of ninety‑one scanning engines, providing independent confirmation that the site exhibits malicious behavior. The domain is listed on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple threat‑intelligence feeds have correlated the indicator with phishing activity. Risk assessment rates the domain as high, reflecting both the presence of multiple vendor detections and its active status.

Uncertainties remain regarding the specific lure or credential‑stealing page content, as no page title or SSL metadata has been disclosed. Defenders should add the IP 35.157.26.135 to network‑level deny lists, enforce DNS filtering for the domain, and monitor for any outbound connections to Netlify‑hosted assets from compromised endpoints. Continuous re‑scanning on VirusTotal and periodic checks against blocklist feeds are recommended to capture any changes in detection scores or additional hosting modifications.