moonshot-listing-rcs[.]netlify[.]app

moonshot-listing-rcs.netlify.app is an active phishing domain impersonating Moonshot. It aims to deceive users into voting their tokens for listing, a ploy likely designed to harvest sensitive information or steal cryptocurrency. This domain is hosted on Netlify and utilizes an IP address registered to Amazon.com, Inc. in Germany. The SSL certificate is issued by DigiCert Inc, adding a layer of perceived legitimacy.

Despite being flagged by only 1 out of 91 vendors on VirusTotal, the domain's presence on three public blocklists, including PhishDestroy, MetaMask, and SEAL, underscores its malicious intent. PhishDestroy's early detection on 2026-06-21 highlights the domain's recent emergence, exploiting the typical 24-72 hour gap before AV databases update. The platform risk score of 83 out of 100 further indicates a high threat level.

The use of a reputable registrar and SSL issuer, coupled with the impersonation of a known brand, suggests a sophisticated phishing operation. This approach is designed to lure victims into a false sense of security, increasing the likelihood of successful exploitation. The domain's active status and strategic deployment signal ongoing risks to users interacting with Moonshot-related content.

PhishDestroy's proactive identification of moonshot-listing-rcs.netlify.app as a threat is crucial for mitigating potential damage. By recognizing this domain as a phishing site early, organizations and individuals can better protect themselves from falling victim to its schemes. The domain's inclusion in multiple blocklists further aids in preventing user access and reducing the impact of its malicious activities.