moonshot-voting-4ioc4v[.]netlify[.]app

moonshot-voting-4ioc4v.netlify.app is a phishing domain designed to impersonate the brand Moonshot. Despite having no detections on VirusTotal, it is listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL. This site is hosted on an Amazon IP address in Germany, with its SSL certificate issued by DigiCert.

The domain is part of a phishing campaign that exploits the early detection window, taking advantage of the 24-72 hour gap before antivirus databases update. PhishDestroy's systems have identified this threat during this critical period, highlighting its freshness and potential danger. The lack of VirusTotal detections is not indicative of safety but rather the domain's newness and the speed at which it was identified.

Registered through Netlify, the site uses a DigiCert SSL certificate, which may lend it an appearance of legitimacy to unsuspecting users. This tactic is common among phishing operations, aiming to deceive individuals into believing they are interacting with a legitimate Moonshot service. The presence of this domain on multiple blocklists underscores the necessity for organizations to remain aware of such threats, especially those targeting recognized brands like Moonshot.