app[.]moonshot[.]show

Analysis on July 22, 2026 identifies app.moonshot.show as an active phishing domain. Infrastructure checks reveal the domain resolves to IP address 104.21.33.198 but currently lacks assigned nameservers, a configuration that may indicate recently deployed or rapidly rotated hosting. The domain appears on one security blocklist, suggesting initial detection by at least one vendor, while a PhishDestroy rule has already blocked access.

No vendor detections are recorded in VirusTotal scans at the time of this report, though the absence of flags does not confirm legitimacy. The domain remains operational, returning a live HTTP status, but the specific brand or service being impersonated is not yet determined from available metadata. No page title, phishing kit signature, or targeted brand is currently identified in open-source intelligence.

Defenders should treat app.moonshot.show as an unverified but high-risk endpoint. Network-level blocking is recommended until further analysis confirms the exact nature of the threat, particularly given the domain's presence on a security blocklist and its unresolved nameserver status. Additional monitoring of associated IP ranges and SSL certificates is advised to track potential infrastructure reuse.