reward-moonwell[.]fi

This domain, reward-moonwell.fi, is flagged as a generic phishing threat with high risk. It was registered on March 30, 2026, through Key-Systems GmbH and remains active as of July 12, 2026. The page title, Moonwell - Rewards Proposal, suggests it impersonates the Moonwell DeFi platform, likely targeting cryptocurrency users with a fake rewards claim. Infrastructure analysis shows the domain resolves to IP 172.67.183.217 and uses Cloudflare services including Browser Insights and HTTP/3, with a Let's Encrypt SSL certificate. Threat intelligence sources indicate broad recognition of malicious activity. AlienVault OTX lists the domain in 23 threat intelligence pulses. VirusTotal reports 5 of 95 security vendors flagging the domain, and it appears on 5 security blocklists. The domain is blocked by SEAL, MetaMask, ScamSniffer, PhishDestroy, and BLP-Malware. Defenders should add this domain to blocklists, monitor for related subdomains, and warn users about unsolicited reward proposals referencing Moonwell.