checker[.]madnessexchange[.]com

Analysis of checker.madnessexchange.com confirms a high-risk brand impersonation operation targeting Monad, a decentralized exchange platform. The domain, registered on February 21, 2026, through HOSTINGER operations, UAB, was taken offline as of the report date. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers theo.ns.cloudflare.com and tori.ns.cloudflare.com, resolving to 188.114.97.3. No SSL certificate was present, increasing exposure to interception risks. The page title, 'Madness - The Lead DEX Built on Monad - ...', explicitly claims affiliation with Monad, aligning with the scam type classified as a fake exchange.

Detection coverage includes 16 of 93 security vendors on VirusTotal flagging the domain, while Google Safe Browsing labels it as social engineering. The domain appears on four security blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. Gridinsoft assigns a trust score of 0/100, further corroborating malicious intent. The absence of an SSL certificate and reliance on Cloudflare infrastructure are consistent with phishing campaigns seeking to obscure origin while maintaining low-cost hosting.

Defenders should treat this domain as confirmed malicious, prioritizing blocklisting at DNS and proxy layers. The combination of brand impersonation, fake exchange classification, and multi-vendor detections warrants immediate action. While the domain is currently offline, monitoring for re-registration or DNS changes is recommended. No evidence links this campaign to other known threat actors or kits, and the exact content beyond the page title remains unanalyzed.