multiplier-moonwell[.]com

This domain, multiplier-moonwell.com, is flagged as a generic phishing site specifically targeting users of the Moonwell decentralized finance (DeFi) platform. Analysis of the page title, 'moonwelldefi,' confirms the domain is impersonating the legitimate Moonwell protocol to deploy wallet drainer malware. No specific drainer kit variant has been conclusively identified, but the infrastructure aligns with known DeFi phishing campaigns designed to harvest private keys and execute unauthorized token transfers. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain resolves to the IPv6 address 2606:4700:3035::6815:3ba9, hosted behind Cloudflare’s network. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious. It appears on four distinct security blocklists, including Polkadot, Codeesura, PhishDestroy, and Enkrypt. The domain was registered on August 22, 2025, through Tucows Domains Inc., with a Gridinsoft trust score of 0/100, indicating maximum risk. No Google Safe Browsing (GSB) listing was observed at the time of analysis, though this may reflect detection latency rather than absence of threat. The domain is currently offline, reducing immediate exposure risk. However, the infrastructure remains registered and could be reactivated or repurposed for future phishing operations. Users who interacted with the site prior to takedown should assume credential or private key compromise and perform a full security audit of connected wallets. All transactions originating from this domain should be treated as fraudulent. Network defenders are advised to block the domain and associated IP at perimeter level, while monitoring for related domains registered through the same registrar or resolving to identical infrastructure.