moonshot-voting-se9yt5[.]netlify[.]app

The domain moonshot-voting-se9yt5.netlify.app is actively impersonating the Moonshot brand. Despite having zero detections on VirusTotal, it has already been flagged by three public blocklists, including PhishDestroy, MetaMask, and SEAL. This early detection highlights the domain's freshness and the potential threat it poses to users during the critical early phase before antivirus databases update.

Hosted on an Amazon server in the US, the site uses a DigiCert-issued SSL certificate, lending it an appearance of legitimacy. The page title, "Moonshot – Vote your token to get listed!", suggests a phishing campaign aimed at collecting sensitive information from users under the guise of a token voting mechanism. This tactic is designed to exploit the trust users place in the Moonshot brand, potentially leading to financial or personal data theft.

PhishDestroy detected this domain on June 22, 2026, capturing it during the pre-propagation window when many traditional antivirus solutions have not yet updated their databases. The domain's abuse score of 11/100 indicates some level of malicious activity, though it remains relatively low. As the domain is still active, it is crucial for users interacting with Moonshot-related platforms to remain aware of potential phishing attempts.