moonshot-voting-jkn[.]netlify[.]app

PhishDestroy has identified an active credential theft domain, moonshot-voting-jkn.netlify.app, which is currently posing as a legitimate voting platform to harvest user credentials. This domain was flagged under the generic phishing category with a status marked as active, and it remains unresolved despite zero detections across 95 VirusTotal engines as of the latest scan. The domain resolves to a Netlify-hosted IP address, 63.176.8.218, which has not yet been flagged by major security vendors, indicating a potential blind spot in detection mechanisms.

Technical analysis reveals that this domain is registered through Netlify, a platform often exploited by threat actors due to its legitimate hosting services being repurposed for malicious campaigns. The lack of detections on VirusTotal (9/95) suggests that this domain is either newly deployed or employs evasion techniques to bypass initial scrutiny. Given the generic nature of the phishing campaign and the absence of immediate blocking by security solutions, there is a heightened risk of user engagement, particularly among individuals expecting legitimate voting-related communications. The domain’s recent activity and low detection rate make it a prime candidate for credential harvesting, where unsuspecting users may input sensitive login information.

If you or your organization has interacted with moonshot-voting-jkn.netlify.app, assume compromise and rotate credentials immediately, especially those used for voting or authentication services. Enable multi-factor authentication (MFA) on all related accounts to mitigate further risk. Report the domain to your security team or block it at the network level using the IP address 63.176.8.218 and the domain name to prevent additional access. Monitor accounts for unusual activity, such as unauthorized logins or data exfiltration, and consider deploying endpoint detection and response (EDR) solutions to detect potential follow-on attacks. Proactive blocking and user awareness are critical to preventing credential theft and downstream compromise.