moonwellrewards[.]com

Analysis of moonwellrewards.com indicates that the domain was registered on July 18 2025 through NameSilo, LLC and is presently resolved to the Cloudflare address 104.21.22.158, which is associated with AS13335 in the United States. The site presents a fake airdrop scheme, as identified by the supplied scam type, and carries an SSL certificate labeled WE1. Gridinsoft assigned a trust score of 0 / 100, and two of ninety‑three VirusTotal scanners flagged the domain, confirming malicious intent. The domain is listed on five external blocklists and has been actively blocked by multiple anti‑phishing services, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura.

Current operational status is offline, suggesting the site has been taken down or is temporarily inaccessible. Evidence confirms that the infrastructure is built on Cloudflare’s edge network, which can obscure the true origin of the payload but also provides a rapid content delivery path. No additional page‑title or brand‑specific metadata has been disclosed, limiting insight into the exact landing‑page content. The lack of publicly available HTTP response codes or content hashes prevents deeper payload analysis at this time.

Defenders should continue to enforce blocks on 104.21.22.158 and any sub‑domains of moonwellrewards.com across perimeter firewalls, DNS filtering, and endpoint protection solutions. Given the low trust score and the presence on multiple blocklists, the domain should be classified as high‑confidence malicious in security policies. Monitoring for re‑registration or the emergence of new IP addresses tied to the same registrar is advised, as threat actors often migrate to fresh infrastructure after takedown. Incident response teams should also review any recent internal traffic logs for connections to this domain within the past year, as the short operational window (approximately one year after creation) aligns with typical phishing campaign lifetimes.