moonshot-listing-atp[.]netlify[.]app

moonshot-listing-atp.netlify.app is actively impersonating the Moonshot brand, enticing users to vote their tokens for listings. This domain is flagged by 3 out of 91 vendors on VirusTotal, indicating a growing awareness of its malicious intent. It is also listed on public blocklists from PhishDestroy, MetaMask, and SEAL, reflecting its recognition as a threat.

The domain is hosted on an IP address in Germany, under Amazon's ASN, and uses an SSL certificate issued by DigiCert. Despite its recent detection on June 21, 2026, the domain's platform risk score is notably high at 83/100, suggesting a significant threat level. Its abuse score, however, remains relatively low at 19/100, which may indicate limited immediate reports of abuse or exploitation.

PhishDestroy's early detection of this domain highlights the importance of identifying threats in the critical window before antivirus databases update. The domain exploits the gap between registration and detection, emphasizing the need for proactive threat intelligence. As it stands, moonshot-listing-atp.netlify.app serves as a reminder of the persistent and evolving nature of phishing scams.