movemoney-reward[.]xyz

This domain, movemoney-reward.xyz, was registered on June 07, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to Cloudflare nameservers derek.ns.cloudflare.com and june.ns.cloudflare.com. It appears on three public security blocklists and is actively listed by PhishDestroy, MetaMask, and SEAL, indicating that multiple mitigation services have taken it down. VirusTotal analysis shows that six of ninety‑one scanners flagged the domain, reinforcing the suspicion that it is being used for malicious activity.

The reported threat type is generic phishing, and the risk rating is elevated, suggesting that the domain is likely employed to harvest credentials or financial information. No additional technical details such as hosting IP, SSL certificate, or page title have been released, so the exact payload and lure remain unknown. Defenders should continue to block the domain at perimeter filters, update DNS blacklists, and monitor for any outbound connections to the associated Cloudflare nameservers.

Organizations that rely on MetaMask should ensure that extension‑level protections remain enabled, as the domain has already been added to MetaMask’s blocklist. Because the domain is recent and actively flagged, threat hunters should also watch for similar registrations from the same registrar or using the same nameserver pattern, as they may indicate a broader campaign. Until further forensic evidence is gathered, the safest posture is to treat any traffic to movemoney-reward.xyz as malicious and prevent user interaction.