vote-moonwell[.]fi

This domain, vote-moonwell.fi, is flagged as an active fake airdrop phishing site targeting users of the Moonwell protocol, as indicated by the page title 'Moonwell - Rewards Proposal' and confirmed scam classification. Registered on March 24, 2026, through Key-Systems GmbH, the domain resolves to 188.114.96.3, a Cloudflare-hosted IP in Canada, and uses Cloudflare nameservers (huxley.ns.cloudflare.com, kiki.ns.cloudflare.com). The site employs Cloudflare Browser Insights and HTTP/3, with a Let's Encrypt SSL certificate (E7). A 301 HTTP status suggests redirection to another endpoint, though the final destination remains unconfirmed. Four security blocklists (PhishDestroy, MetaMask, SEAL, ScamSniffer) currently block this domain, and Gridinsoft assigns it a trust score of 0/100. While only one of 94 security vendors on VirusTotal flags the domain, this does not diminish its risk, as phishing detection often relies on real-time behavioral analysis rather than static signatures. Defenders should treat this domain as high-risk, particularly for credential harvesting or wallet-draining attacks targeting cryptocurrency users. Immediate blocking at the DNS or proxy level is recommended, alongside monitoring for related infrastructure (e.g., subsequent domains, IPs, or SSL certificates). Further analysis of the redirection chain and any associated JavaScript payloads is advised to identify additional indicators of compromise.