moonshot-listing-tsl[.]netlify[.]app

moonshot-listing-tsl.netlify.app actively impersonates the Moonshot brand, luring users with a fraudulent token listing scheme. With 12 out of 91 vendors on VirusTotal flagging it as malicious, the domain demonstrates a significant threat level. It is also listed on public blocklists from PhishDestroy, MetaMask, and SEAL, indicating awareness of its malicious activities.

The domain is hosted on an IP address associated with Amazon's infrastructure in Germany, under AS16509. This hosting choice may lend it an air of legitimacy, but the site's true purpose is to deceive users into believing they can vote for their token to be listed on Moonshot. The platform risk score is a perfect 100/100, reflecting the high potential for user exploitation.

Despite the relatively low abuse score of 19/100, the domain's impersonation of Moonshot and its active status make it a pressing concern. The SSL certificate issued by DigiCert further disguises its malicious intent, potentially misleading users into trusting the site. PhishDestroy's early detection on June 20, 2026, underscores the importance of identifying such threats before they proliferate.

This domain exemplifies how phishing operations can exploit brand recognition to execute scams. By masquerading as a legitimate service, it seeks to harvest sensitive information or financial contributions from unsuspecting victims. The combination of early detection and public blocklisting is crucial in mitigating the impact of such threats.