claims-moonwell[.]xyz

The domain claims-moonwell.xyz was registered on May 11 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It is hosted behind Cloudflare, using the authoritative nameservers dahlia.ns.cloudflare.com and gabriel.ns.cloudflare.com, and resolves to the IP address 188.114.97.3, which resolves to a Cloudflare facility in Canada. The TLS certificate is issued by Let’s Encrypt (E7), and the web server returns an HTTP 403 status with the page title “Just a moment…”.

Threat intelligence links the domain to the crypto‑drainer category. An AlienVault OTX pulse references it, and three independent security blocklists have already listed the domain. Additional blocking by PhishDestroy, MetaMask, and SEAL reinforces the view that defensive products consider it malicious. VirusTotal scans show three of ninety‑five antivirus engines flag the domain, and Gridinsoft assigns a trust score of 0 out of 100, indicating a strong confidence of abuse.

The observable data does not include a captured payload or a detailed description of the draining technique, so the exact method used to exfiltrate cryptocurrency remains uncertain. The 403 response may be a deliberate obfuscation tactic that permits malicious scripts to execute only in browsers that bypass the error page, while the Cloudflare front‑end masks the true origin infrastructure, limiting deeper forensic insight.

Defenders should treat claims-moonwell.xyz as a high‑risk crypto‑drainer and block it at network perimeters, DNS resolvers, and endpoint security solutions. Monitoring for connections to 188.114.97.3, especially over TLS, can help identify compromised clients. Because the domain presents a valid Let’s Encrypt certificate, TLS inspection or certificate pinning may be required to reveal hidden malicious content behind the 403 response. Continuous ingestion of the related blocklist entries and OTX pulse updates will keep detection mechanisms aligned with evolving indicators.