moonshot-listing-hna[.]netlify[.]app

Analysis of moonshot-listing-hna.netlify.app indicates an active generic phishing operation hosted on Netlify infrastructure. The domain resolves to IP address 35.157.26.135, a Netlify edge node commonly used for short-lived content delivery. DNS resolution data reports NS_NOT_FOUND, suggesting the site relies on Netlify's default nameserver configuration rather than custom delegations. The domain was submitted to VirusTotal and examined by 91 antivirus and sandbox engines; none of the engines generated a detection, but the absence of flags does not constitute evidence of benign intent.

The site appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming community consensus that the domain is being used for malicious phishing campaigns. Registration details show the domain was provisioned through Netlify, a platform that permits rapid deployment of static sites without extensive verification, a characteristic often abused by threat actors to launch temporary phishing pages. Current status is listed as active, meaning the site is reachable and capable of delivering malicious payloads or credential‑harvesting pages. No additional data such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, OTX indicators, or page titles are presently available, leaving those aspects of the infrastructure unverified.

Defenders should prioritize immediate DNS or URL filtering of the domain, enforce endpoint blocking of the associated IP range, and monitor outbound traffic for connections to the Netlify edge node. Incident response teams are advised to submit takedown requests to Netlify and to share the indicator set with threat‑intelligence sharing platforms to accelerate broader mitigation. Continuous re‑assessment is recommended, as the domain may change hosting or content rapidly, typical of phishing operations hosted on cloud‑based platforms.