moonwellvote[.]life

Analysis of moonwellvote.life shows the domain is actively being used for a generic phishing operation and is currently under investigation. The site has been added to three independent security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, indicating that multiple threat‑intelligence feeds have observed malicious activity originating from this host. VirusTotal records reveal that the domain was scanned by 91 antivirus and URL‑reputation vendors; none of the scanners raised a detection at the time of the scan.

While the lack of detections does not constitute a safety guarantee, it confirms that the domain has not yet been fingerprinted by automated malware signatures. No public information is available regarding the registrar, registration date, ASN, hosting provider, SSL certificate details, HTTP response codes, or Safe Browsing status, and the page title has not been disclosed in the current intelligence set. Consequently, the precise infrastructure footprint of moonwellvote.life remains opaque, and attribution of the underlying threat actor cannot be established from the existing data.

Defenders should treat the domain as hostile: add it to DNS‑ and proxy‑based deny lists, enforce network‑level blocking, and monitor outbound connections for any attempts to resolve or contact the host. Continuous re‑evaluation is recommended, as future scans may uncover additional indicators such as malicious payloads, credential‑harvesting forms, or expanded hosting footprints that could refine the risk profile.