moonshot-listing-bhm[.]netlify[.]app

moonshot-listing-bhm.netlify.app impersonates Moonshot, a popular brand, to deceive users into voting for tokens. The domain is flagged by 11 out of 91 VirusTotal vendors, indicating a significant threat presence. Public blocklists from PhishDestroy, MetaMask, and SEAL also include this domain, underscoring its malicious nature. Hosted on Amazon's infrastructure in Germany, it leverages Netlify's platform for distribution.

The scam operates by enticing users to vote for tokens, a common tactic to engage cryptocurrency enthusiasts. The page, titled "Moonshot – Vote your token to get listed!", mimics legitimate token listing sites, aiming to capture sensitive user information. The platform risk score is a perfect 100, highlighting the high potential for harm. Despite a low abuse score of 1, the domain's activity is concerning due to its sophisticated impersonation tactics.

PhishDestroy first identified this domain on June 20, 2026, showcasing our proactive detection capabilities. The domain's use of a DigiCert-issued SSL certificate adds a veneer of legitimacy, potentially misleading users. This case exemplifies how phishing domains exploit trusted platforms and infrastructure to execute scams. Continuous monitoring and early detection are crucial in mitigating such threats.