moonshot-listing-eif[.]netlify[.]app

moonshot-listing-eif.netlify.app is an active phishing domain impersonating Moonshot to deceive users into voting for token listings. The site is hosted on Amazon's infrastructure in Germany and uses a DigiCert-issued SSL certificate, lending a false sense of legitimacy. Despite its recent detection on June 21, 2026, by PhishDestroy, the domain already appears on three public blocklists, including MetaMask and SEAL.

The domain's presence on VirusTotal shows only one out of 91 vendors flagging it as malicious, indicating its relative freshness in the threat landscape. This low detection rate highlights the domain's potential to exploit the critical 24-72 hour window before antivirus databases update, allowing it to operate under the radar of most security solutions. PhishDestroy's upstream detection capability is crucial in identifying such threats early.

The phishing operation targets users by mimicking Moonshot's branding, with a page titled 'Moonshot – Vote your token to get listed!' This strategy aims to engage users in fraudulent activities, potentially leading to financial losses or data breaches. The platform risk score of 83/100 underscores the significant threat this domain poses to unsuspecting users.

Given its active status and the strategic impersonation of a known brand, moonshot-listing-eif.netlify.app represents a sophisticated attempt to deceive users. The combination of a high platform risk score and a relatively low abuse score suggests that the domain is well-crafted to evade immediate detection while effectively targeting its audience. Continued vigilance and early detection remain key in mitigating the risks associated with such phishing domains.