moonshot-listing-26c[.]netlify[.]app

This report evaluates the domain moonshot-listing-26c.netlify.app as of August 05, 2026, in the context of ongoing credential theft activity. Technical evidence shows the domain is hosted through Netlify and resolves to IP address 35.157.26.135. DNS data indicates nameservers are not found, which may suggest either recent setup, misconfiguration, or intentional obfuscation. The domain is currently active and has been identified as high risk by multiple security entities. It appears on three recognized security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. The presence on these blocklists points to a consensus among major threat intelligence providers regarding its use in malicious operations, specifically targeting credential theft.

VirusTotal results indicate it has been scanned by 91 vendors, with no current detections. However, the absence of vendor detections does not constitute evidence of safety; the domain’s blocklist status overrides this as an indicator. There is no information available about the site's page title, content, or specific brand targeting, and no Safe Browsing or OTX data is referenced in the current intelligence. As such, the exact content and lure techniques used on this domain remain unverified at this time.

Given its active state, high-profile blocklist inclusion, and the lack of positive security detections, defenders should treat any traffic to or from moonshot-listing-26c.netlify.app as hostile. It is recommended to add this domain and its associated IP to internal blocklists, monitor for access attempts in network logs, and alert users to avoid any interaction with it. Ongoing monitoring for related domains and infrastructure is advised, as threat actors often rotate or spawn similar Netlify-hosted assets to evade detection.