moonlit-phoenix-8039b7[.]netlify[.]app

Analysis indicates that the Netlify‑hosted domain moonlit-phoenix-8039b7.netlify.app is currently active and classified as a high‑risk generic phishing site. The domain appears on two independent security blocklists and is explicitly listed by PhishDestroy and OpenPhish as a malicious host. Google Safe Browsing has flagged the domain for social engineering, confirming that major web‑browser defenses consider it unsafe for end‑users.

VirusTotal scans show that 14 of 91 security vendors have raised detections against the domain, reinforcing the suspicion that the site is being used for credential‑stealing or related fraudulent activity. The available intelligence does not include details such as the underlying page title, SSL certificate metadata, hosting IP address, or any observed payload, leaving the exact phishing lure and target brand unspecified. Consequently, defenders cannot rely on content‑based indicators to block the site; instead, they should prioritize network‑level and DNS‑based mitigations.

It is recommended that security teams add moonlit-phoenix-8039b7.netlify.app to existing URL filtering and DNS blocklists, enforce strict safe‑search policies, and monitor outbound connections for attempts to resolve or contact the domain. Incident response units should also correlate any user‑reported suspicious login attempts with this indicator to identify potential compromised credentials. Continuous re‑evaluation is advised, as additional telemetry such as page snapshots or payload analysis may emerge, allowing more granular detection rules in the future.