moonshot-listing-tw0[.]netlify[.]app

Analysis of moonshot-listing-tw0.netlify.app indicates an active generic phishing threat. The domain resolves to the IPv4 address 63.176.8.218 and is hosted on Netlify, a platform commonly used for rapid site deployment. Registration details point to Netlify as the registrar, and the domain’s nameserver information is unavailable (NS_NOT_FOUND), which limits attribution of DNS control.

Infrastructure profiling shows no anomalous port activity beyond standard HTTP/HTTPS services; however, the underlying Netlify infrastructure can obscure the true origin of the hosted content. The domain is listed on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple independent threat‑intelligence feeds have flagged it as malicious. VirusTotal scans have been performed by 91 vendors, yet no detections were reported; this absence should not be interpreted as a safety indicator, as the scans may have pre‑dated the deployment of the phishing payload or the content may be dynamically generated.

No page title or content analysis is currently available, leaving the exact lure or credential‑collection technique unverified. Defenders should prioritize immediate network‑level blocking of the domain and its IP address, incorporate the domain into URL filtering rules across web gateways, and monitor for any new subdomains or related Netlify‑hosted assets that share the same IP range. Continuous re‑scanning with dynamic analysis tools is advised to capture any evolving payloads, and threat‑intel teams should correlate this indicator with any observed credential‑theft incidents to assess compromise scope.