moonshotvote-ug[.]netlify[.]app

This domain is flagged as a credential harvesting scam designed to mimic legitimate authentication portals. Analysis indicates it is actively soliciting user logins, passwords, or other sensitive data through deceptive web forms, a common tactic in phishing campaigns targeting unsuspecting victims. The infrastructure is hosted on a platform known for rapid deployment of malicious sites, increasing the likelihood of short-lived but high-impact attacks. Infrastructure analysis reveals the domain is registered through Netlify, a service frequently abused for phishing due to its free hosting and ease of setup. As of the latest scan, VirusTotal reports 0 detections out of 95 security engines, suggesting the threat is either new or employs evasion techniques to bypass detection. The domain resolves to the IP address 35.157.26.135, which has no prior blocklist history but is part of a network segment associated with transient malicious activity. No creation date is publicly available, but the lack of detections and active status indicate it may have been recently deployed. Users who have visited moonshotvote-ug.netlify.app or entered credentials on the site should assume their data has been compromised. Immediate steps include changing passwords for any accounts accessed through the domain, enabling multi-factor authentication where available, and monitoring for unauthorized activity. If financial or personally identifiable information was submitted, affected individuals should review account statements and consider placing fraud alerts with relevant institutions. Security teams are advised to block the domain and IP at the network level to prevent further exposure.