reward-moonwell[.]xyz

PhishDestroy identifies reward-moonwell.xyz as a generic phishing domain masquerading as the legitimate Moonwell protocol. The domain leverages homoglyphs and brand impersonation to harvest wallet credentials and seed phrases. While no custom drainer kit artifacts have been confirmed in public sandboxes, the page likely serves a clipboard-modifying or wallet-draining JavaScript payload once a victim connects their wallet, consistent with current Moonwell-themed phishing campaigns observed in Q2 2026. This domain was flagged under investigation with a VirusTotal detection score of 1/95 detections as of the seed timestamp a97a72. The domain resolves to IP address 188.114.97.3, is registered through PDR Ltd. d/b/a PublicDomainRegistry.com, and was created on June 10, 2026. Google Safe Browsing (GSB) has not yet flagged this domain, and it currently appears on zero public blocklists. The fresh registration and zero detections indicate a low-profile, high-precision operation likely targeting early adopters of the Moonwell DeFi protocol. The domain remains active and poses a direct threat to cryptocurrency users seeking to engage with Moonwell. PhishDestroy recommends immediate network-level and endpoint blocking of 188.114.97.3 and the domain reward-moonwell.xyz. Users should avoid accessing the site, verify all links via reputable sources, and consider revoking any exposed wallet permissions. Although detection coverage is currently low, ongoing monitoring and proactive threat hunting are essential to prevent credential or fund loss. The risk level remains under investigation but is classified as active due to confirmed impersonation and operational indicators.