apps-moonwell[.]xyz

The domain apps-moonwell.xyz has been identified as a confirmed phishing site with a high risk level. Registered on March 23, 2026, this domain is currently active and resolves to the IP address 188.114.97.3. The infrastructure analysis indicates the use of Cloudflare and HTTP/3 technologies, which may be employed to enhance the site's performance and obfuscate its true nature. The page title displayed is "apps-moonwell.xyz | 504: Gateway time-out," suggesting potential server issues that could affect accessibility for users attempting to reach this site.

Threat intelligence data reveals that apps-moonwell.xyz has been included in 23 threat intelligence pulses on AlienVault OTX, confirming its malicious reputation. Additionally, it is flagged by 15 out of 95 security vendors on VirusTotal, indicating a considerable level of concern among cybersecurity professionals. The domain has been blocked by multiple security entities, including SEAL, MetaMask, PhishDestroy, and BLP-Malware, further corroborating its classification as a phishing threat. It is also listed on four known security blocklists, which serve as additional layers of protection against such fraudulent activities.

The SSL certificate for this domain is issued by Let's Encrypt, which is commonly used by both legitimate and malicious sites alike. The Gridinsoft trust score for apps-moonwell.xyz is notably low at 0 out of 100, highlighting a complete lack of trustworthiness. Defenders should be vigilant against any communications or interactions involving this domain and should implement strict URL filtering to prevent access. Continuous monitoring of threat intelligence feeds is also recommended to stay updated on evolving phishing tactics associated with this and similar domains.