moonshot-voting-vvd30w[.]netlify[.]app

moonshot-voting-vvd30w.netlify.app is a phishing site actively impersonating the brand Moonshot. The site claims to allow users to vote for their token to get listed, a tactic often used to lure victims into providing sensitive information. Despite having zero detections on VirusTotal, this domain is already listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL.

The site is hosted on an IP address located in Germany, specifically under the AS16509 Amazon.com, Inc. network. The domain is registered through Netlify and employs an SSL certificate issued by DigiCert Inc, which might give an illusion of legitimacy to unsuspecting users. The early detection of this domain by PhishDestroy highlights the critical window before anti-virus databases update, emphasizing its freshness rather than safety.

Phishing domains like moonshot-voting-vvd30w.netlify.app exploit the gap between domain registration and the propagation of detection signatures across security vendors. This period, typically 24-72 hours, is crucial for threat actors to execute their scams. PhishDestroy's proactive monitoring captures these threats during this vulnerable window, providing an essential layer of defense against emerging phishing attacks.