moonshot-listing-cyo[.]netlify[.]app

The domain moonshot-listing-cyo.netlify.app was registered on June 21, 2026 through the Netlify hosting platform and resolves to the IP address 63.176.8.218, which is allocated to Amazon.com, Inc. in Germany (AS16509). The site presents a TLS certificate issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, confirming the use of HTTPS. HTTP requests return a 404 status, and the page title observed is "Vote to List — Powered by Moonshot," indicating a likely attempt to masquerade as an official Moonshot service. The domain is flagged on three independent blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating that multiple security providers have identified it as malicious.

VirusTotal analysis shows that 14 of 91 scanning engines have marked the domain as malicious, reinforcing the suspicion. Additional telemetry shows a Gridinsoft trust score of 0 out of 100, and the domain lacks resolvable nameserver records (NS_NOT_FOUND), suggesting possible manipulation of DNS settings. The infrastructure uses Netlify and HSTS, common components for legitimate sites, which may be abused to lend credibility.

Although the site is currently offline and returns a 404, the presence on blocklists and the detection count indicate that it was actively used for brand‑impersonation targeting Moonshot. Defenders should update perimeter filters to block the domain and its associated IP range, monitor Netlify‑hosted assets for similar patterns, and advise users to disregard any unsolicited communications referencing the observed page title. Continuous surveillance of the Netlify environment and the listed blocklists is recommended to detect any re‑activation of this infrastructure.