moonwelll[.]com

The domain moonwelll.com is a generic phishing site that does not impersonate a specific brand or deploy a known crypto drainer kit. As of the latest verification, the site has been taken offline, but it previously posed an elevated risk of credential theft or other fraudulent activity. Users searching whether moonwelll.com is safe or a scam should treat it as malicious, given its history of phishing attempts.

Technical indicators confirm the domain's suspicious nature. moonwelll.com was flagged by 2 of 95 security vendors on VirusTotal, including Ermes and Gridinsoft, though Google Safe Browsing did not detect it. It appeared on 5 security blocklists, including PhishDestroy, ScamSniffer, and Polkadot. The domain was registered through NameSilo, LLC on February 21, 2026, and resolved to the IP address 104.21.48.1, hosted by Cloudflare in the US. The SSL certificate was issued by Google Trust Services (WE1), and the site used Cloudflare nameservers (ivy.ns.cloudflare.com, noah.ns.cloudflare.com). The observed page title was 'moonwelll.com | 522: Connection timed out,' and the site employed Cloudflare and HTTP/3 technologies.

Individuals who interacted with moonwelll.com should take immediate safety steps. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Monitor accounts for unauthorized activity and report any fraud to financial institutions. To report the domain, submit it to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities. Victims of phishing should also consider filing a complaint with organizations such as the FBI’s IC3 or their national cybercrime reporting center.