moonshot-voting-akdeud[.]netlify[.]app

The domain moonshot-voting-akdeud.netlify.app is actively targeting users by impersonating the brand Moonshot. Despite having zero detections on VirusTotal, this domain is flagged in three public blocklists, including PhishDestroy, MetaMask, and SEAL. It highlights the critical window of vulnerability between domain registration and antivirus database updates, which cybercriminals exploit to conduct phishing attacks.

Hosted on an Amazon server in Germany, the domain uses a DigiCert-issued SSL certificate, adding a layer of legitimacy to its phishing activities. The registrar, Netlify, is a popular platform for hosting such malicious domains due to its ease of use and rapid deployment capabilities. This domain's early detection by PhishDestroy underscores the importance of proactive threat intelligence in identifying and mitigating risks before they propagate through traditional antivirus channels.

The phishing operation aims to deceive Moonshot users into divulging sensitive information, potentially leading to financial loss or identity theft. By leveraging the brand's trust, attackers can more easily lure victims into their trap. The presence of this domain in multiple blocklists indicates its recognition as a threat by the cybersecurity community, yet the lack of VirusTotal detections suggests it is a fresh threat. This situation exemplifies how timely intelligence can prevent potential damage by alerting users and organizations to emerging threats before they become widespread.