moonshot-listing-n6h[.]netlify[.]app

Analysis as of August 06, 2026 identifies moonshot-listing-n6h.netlify.app as an active generic phishing infrastructure. The domain is hosted on Netlify, as indicated by the registration pathway and the resolved IPv4 address 18.208.88.157, which belongs to Netlify’s CDN range. The domain resolves without custom nameserver records; the authoritative nameserver query returned NS_NOT_FOUND, suggesting reliance on Netlify’s default DNS configuration. The site is listed on three reputable security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat intelligence providers have observed malicious activity associated with the domain. VirusTotal has processed 91 independent scanners for the domain; none of the engines generated a detection at the time of analysis.

While the lack of detections does not constitute a safety assurance, it reflects that the payload or page content may be evasive or that the detection signatures have not yet been updated. No public information is available regarding the specific page title, SSL certificate details, HTTP response codes, or any observed brand impersonation. Consequently, the exact phishing lure (e.g., credential harvesting for a particular service) cannot be confirmed without direct content inspection. Defenders should continue to block the domain at network perimeter, DNS, and endpoint layers.

Updating URL filtering rules to include the domain and its IP address is recommended. Monitoring for any new sub‑domains or variations that resolve to the same IP range should be incorporated into threat‑hunting playbooks. Because the domain leverages Netlify’s shared hosting, any future malicious sites may appear under the same IP block, so broader Netlify‑related indicators should be considered.