moonshot-listing-2ee[.]netlify[.]app

moonshot-listing-2ee.netlify.app is a tenant hostname on Netlify, not a separately registered domain. PhishDestroy first observed the hostname on Aug 13, 2026. The hostname explicitly references Moonshot and uses “listing,” a pattern consistent with a token-listing lure; stored content metadata identifies the same apparent target. The captured page title is “Moonshot – Vote your token to get listed!”. Page analysis recorded additional brand references to Celer and Solana. Stored page analysis classifies the content as impersonation. Current evidence score: 100/100 (critical).

Positive findings are stored from 5 sources: VirusTotal, MetaMask, SEAL, Cloudflare Radar, and URLScan. VirusTotal recorded 14 detections among 91 engines: alphaMountain.ai, BitDefender, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Kaspersky, LevelBlue, Lionic, Netcraft, Sophos, VIPRE, Webroot on Aug 15, 2026 at 03:25 UTC. MetaMask and SEAL listed the hostname in the separate external-blocklist snapshot on Aug 15, 2026 at 14:20 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Moonshot and assigned phishing as its category on Aug 13, 2026 at 23:09 UTC. Non-positive and contextual checks: Google Safe Browsing returned no flag on Aug 15, 2026 at 09:36 UTC.

The collector marked the hostname reachable on Aug 13, 2026 at 17:57 UTC, but did not retain the HTTP response code. Netlify is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 63.176.8.218 on AS16509 (AMAZON-02 - Amazon.com, Inc., US). The IP and ASN identify shared Netlify infrastructure, not the tenant operator. DOM analysis on Aug 13, 2026 at 18:22 UTC returned 100/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. The platform TLS certificate was issued by DigiCert Inc with validity through Mar 19, 2027; checked Aug 13, 2026 at 19:02 UTC.

The content indicators and 5 positive source findings support the current Moonshot-themed token-listing phishing classification.