moonshot-voting-ilh3zs[.]netlify[.]app

The domain moonshot-voting-ilh3zs.netlify.app poses as Moonshot, aiming to deceive users into voting for token listings. This phishing site is active and has been detected early in its lifecycle, with 0 out of 91 detections on VirusTotal. It is already flagged by three public blocklists, including PhishDestroy, MetaMask, and SEAL.

Hosted on Amazon infrastructure in Germany, the domain exploits the gap between registration and antivirus database updates. This early detection highlights the importance of preemptive measures in identifying threats before they propagate through traditional security channels. The site uses a legitimate SSL certificate from DigiCert, which may lend false credibility to unsuspecting users.

The phishing operation targets Moonshot's user base, enticing them with a fake voting scheme. The page title, "Moonshot – Vote your token to get listed!", suggests an opportunity for users to influence token listings, a tactic designed to lure victims into providing sensitive information. The domain's abuse score of 19 out of 100 indicates a moderate level of malicious activity, reinforcing the need for continued vigilance against such threats.