moonshot-listing-vfc[.]netlify[.]app

This domain, moonshot-listing-vfc.netlify.app, is under active investigation as a high-risk phishing site targeting cryptocurrency users. Analysis indicates the domain is hosted on Netlify's infrastructure and resolves to the IP address 35.157.26.135, though no nameservers were identified at the time of assessment. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, suggesting it is part of a known malicious campaign. Despite these flags, the domain was scanned by 91 vendors on VirusTotal with no current detections, though the absence of detections does not confirm safety and may reflect a lag in vendor updates or evasion techniques.

Infrastructure analysis reveals the domain is registered through Netlify, a legitimate hosting provider often exploited for phishing due to its free tier and ease of deployment. The IP address 35.157.26.135 is associated with Amazon Web Services, a common hosting environment for both legitimate and malicious sites. No specific brand or phishing kit has been confirmed in the available data, and the exact content of the site remains unanalyzed. Defenders should treat this domain as actively malicious based on its presence on multiple blocklists and its association with known phishing indicators.

Organizations are advised to block access to this domain at the network level and monitor for related indicators, such as the IP address or similar Netlify-hosted subdomains. Given the high-risk classification and active status, further investigation into the domain's payload and potential connections to broader phishing campaigns is recommended. The domain remains operational as of August 06, 2026, and should be handled with caution until additional intelligence is available.