moonshot-listing-kyz[.]netlify[.]app

moonshot-listing-kyz.netlify.app is an active phishing domain impersonating the Moonshot brand. It has been flagged by 7 out of 91 vendors on VirusTotal, indicating a growing awareness among security platforms. The domain is also listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, underscoring its malicious nature.

The phishing site operates under the guise of a token listing page, enticing users to vote for their token to be listed. This is a common tactic to lure cryptocurrency enthusiasts into divulging sensitive information. The domain is hosted on Netlify and uses an IP address located in Germany, under Amazon's AS16509. The SSL certificate is issued by DigiCert, ensuring encrypted connections that might falsely reassure victims of its legitimacy.

Despite its recent detection on June 20, 2026, by PhishDestroy, the domain's activity demonstrates the rapid deployment of phishing campaigns. The platform risk score of 90 out of 100 highlights the significant threat it poses, while the abuse score of 19 out of 100 suggests limited immediate abuse reports, potentially due to its newness. The gap between domain registration and antivirus database updates allows such threats to exploit unsuspecting users effectively. PhishDestroy's upstream detection pipeline captures these threats early, providing crucial intelligence to mitigate risks.